text: On Thu, Oct 16, 2008 at 02:07:57PM -0700, Dan Smith wrote: > Without this, our container child doesn't actually end up in the cgroup, > and thus runs unrestricted. Note that this does not address the container's > ability to mount cgroup and move itself into the parent namespace. > > While making this change, it became clear that we need to allow access to > the entire range of pty devices for the container console to work. This > patch adds that logic as well. Yep, we also need the kernel guys to finish PTS namespace virtualization so we can actually make /dev/pts private to the container :-) :|