From owner-freebsd-stable@FreeBSD.ORG Wed Sep 14 10:04:39 2005 Return-Path: X-Original-To: freebsd-stable@freebsd.org Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6648E16A41F for ; Wed, 14 Sep 2005 10:04:39 +0000 (GMT) (envelope-from rwatson@FreeBSD.org) Received: from cyrus.watson.org (cyrus.watson.org [204.156.12.53]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0DE9943D49 for ; Wed, 14 Sep 2005 10:04:38 +0000 (GMT) (envelope-from rwatson@FreeBSD.org) Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by cyrus.watson.org (Postfix) with ESMTP id 8BEBD46B83; Wed, 14 Sep 2005 06:04:38 -0400 (EDT) Date: Wed, 14 Sep 2005 11:04:38 +0100 (BST) From: Robert Watson X-X-Sender: robert@fledge.watson.org To: Lyndon Nerenberg In-Reply-To: Message-ID: <20050914110102.W33820@fledge.watson.org> References: <432753CF.6020001@bfoz.net> <4327CA3C.6050403@geminix.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: Brandon Fosdick , freebsd-stable@freebsd.org Subject: Re: Jail to jail network performance? X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Sep 2005 10:04:39 -0000 On Wed, 14 Sep 2005, Lyndon Nerenberg wrote: > On Sep 13, 2005, at 11:59 PM, Uwe Doering wrote: > >> Now, for security reasons jails normally are confined in separate >> filesystems, or at least in separate parts of a common one. So in case >> of MySQL you would have to use TCP sockets to communicate between >> jails. This socket type typically consumes more CPU because of TCP's >> protocol overhead. However, whether you would actually notice any >> difference in speed basically depends on how much excess CPU power >> there is available on that server. > > Ignoring security (or filesystem namespace issues) I will just note that > using named sockets for local IPC is a Good Thing. When I worked at > Messaging Direct I taught sendmail to speak LMTP over named sockets, and > our local delivery rate (to our IMAP server) went up by a factor of 10. > > It would be really cool if we could figure out a way to do AF_UNIX > between jails, but I confess to not having thought about any of the > implications ... (Maybe netgraph can help here?) There are several ways you can do it, but they generally fall into two classes of activies: (1) Modifying the name space exclusion assumption for jails, so that the file system name spaces overlap. One way to do this is with nullfs. (2) Having a daemon or tool that runs outside of the jail and brokers communication between the jails. One example might be a daemon that inserts a UNIX domain socket into both jails and then provides references to shared IPC objects between the two "by request". Another example might be a daemon or tool that responds to a request and creates a hard link from a socket/fifo endpoint visible in one jail to a name visible in another jail, perhaps when setting up the jail. The former requires more infrastructure, but the latter is less flexible. Robert N M Watson