title: How to isolate SR-IOV Virtual Fuctions which are bind to DPDK igb_uio driver in docker container from each other
body: <p>I was recently trying to bind SR-IOV VF pci devices to DPDK app  in docker container, the expect scenario : each docker container runs DPDK application which take charge of one sriov VF. But DPDK application can see all sriov VF ports, and this will cause different docker container can handle other VF which may charged by another container.</p>
  <p>the steps are:</p>
  <p><strong>(1) enable SR-IOV function, Virtual Functions are setup correctly</strong> <br/>
  #lspci
  04:10.1 Ethernet controller: Intel Corporation 82599 Ethernet Controller Virtual Function (rev 01) <br/>
  04:10.3 Ethernet controller: Intel Corporation 82599 Ethernet Controller Virtual Function (rev 01) <br/>
  04:10.5 Ethernet controller: Intel Corporation 82599 Ethernet Controller Virtual Function (rev 01) <br/>
  04:10.7 Ethernet controller: Intel Corporation 82599 Ethernet Controller Virtual Function (rev 01) <br/></p>
  <p><strong>(2) run two docker containers</strong> <br/>
  #docker run --privileged --name=&quot;sriov_test&quot; -v /mnt/huge:/mnt/huge -itd centos:latest <br/></p>
  <p><strong>(3)bind VF port to igb_uio drv</strong> <br/>
  #./dpdk-devbind.py -s <br/>
  Network devices using DPDK-compatible driver <br/>
  ============================================ <br/>
  0000:04:10.1 '82599 Ethernet Controller Virtual Function 10ed' drv=igb_uio unused=ixgbevf,vfio-pci <br/>
  0000:04:10.3 '82599 Ethernet Controller Virtual Function 10ed' drv=igb_uio unused=ixgbevf,vfio-pci <br/></p>
  <p><strong>(4)run dpdk application my_basicforwd</strong> <br/>
  #./my_basicfwd -l 1 --log-level 8  -- -p 1 <br/>
  EAL: Detected 4 lcore(s) <br/>
  EAL: Detected 1 NUMA nodes <br/>
  EAL: Multi-process socket /var/run/dpdk/rte/mp_socket <br/>
  EAL: No free hugepages reported in hugepages-1048576kB <br/>
  EAL: Probing VFIO support... <br/>
  EAL: VFIO support initialized <br/>
  EAL: PCI device 0000:00:1f.6 on NUMA socket -1 <br/>
  EAL:   Invalid NUMA socket, default to 0 <br/>
  EAL:   probe driver: 8086:15b7 net_e1000_em <br/>
  EAL: PCI device 0000:04:00.0 on NUMA socket -1 <br/>
  EAL:   Invalid NUMA socket, default to 0 <br/>
  EAL:   probe driver: 8086:10fb net_ixgbe <br/>
  EAL: PCI device 0000:04:00.1 on NUMA socket -1 <br/>
  EAL:   Invalid NUMA socket, default to 0 <br/>
  EAL:   probe driver: 8086:10fb net_ixgbe <br/>
  EAL: PCI device 0000:04:10.1 on NUMA socket -1 <br/>
  EAL:   Invalid NUMA socket, default to 0 <br/>
  EAL:   probe driver: 8086:10ed net_ixgbe_vf <br/>
  EAL: PCI device 0000:04:10.3 on NUMA socket -1 <br/>
  EAL:   Invalid NUMA socket, default to 0 <br/>
  EAL:   probe driver: 8086:10ed net_ixgbe_vf <br/>
  EAL: PCI device 0000:04:10.5 on NUMA socket -1 <br/>
  EAL:   Invalid NUMA socket, default to 0 <br/>
  EAL:   probe driver: 8086:10ed net_ixgbe_vf <br/>
  EAL: PCI device 0000:04:10.7 on NUMA socket -1 <br/>
  EAL:   Invalid NUMA socket, default to 0 <br/>
  EAL:   probe driver: 8086:10ed net_ixgbe_vf <br/></p>
  <p>timer period 33120229810 <br/>
  debug nb_ports 2 <br/>
  Port 0 MAC: 02 09 c0 4b b4 a7 <br/>
  Port 1 MAC: 02 09 c0 3c ce 0f <br/></p>
  <p>Above shows that dpdk can see two VF ports, another container dpdk application result is same.
  I was trying to set the VF ports to docker container's netns by : ip link set xxx netns xxx, unfortunately no use.</p>
  <p>I was searching for a long time on net, but no use. Please help or try to give some ideas how to achieve this, thanks a lot.</p>