From owner-freebsd-stable@FreeBSD.ORG Mon Sep 26 07:55:19 2005 Return-Path: X-Original-To: freebsd-stable@freebsd.org Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9DEBA16A41F for ; Mon, 26 Sep 2005 07:55:19 +0000 (GMT) (envelope-from rwatson@FreeBSD.org) Received: from cyrus.watson.org (cyrus.watson.org [204.156.12.53]) by mx1.FreeBSD.org (Postfix) with ESMTP id 53DDF43D48 for ; Mon, 26 Sep 2005 07:55:19 +0000 (GMT) (envelope-from rwatson@FreeBSD.org) Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by cyrus.watson.org (Postfix) with ESMTP id 7534C46B89; Mon, 26 Sep 2005 03:55:18 -0400 (EDT) Date: Mon, 26 Sep 2005 08:55:18 +0100 (BST) From: Robert Watson X-X-Sender: robert@fledge.watson.org To: Brandon Fosdick In-Reply-To: <43376791.3050609@terrandev.com> Message-ID: <20050926085420.M34322@fledge.watson.org> References: <432753CF.6020001@bfoz.net> <4327CA3C.6050403@geminix.org> <20050914110102.W33820@fledge.watson.org> <43376791.3050609@terrandev.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: freebsd-stable@freebsd.org, Lyndon Nerenberg Subject: Re: Jail to jail network performance? X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Sep 2005 07:55:19 -0000 On Sun, 25 Sep 2005, Brandon Fosdick wrote: > Robert Watson wrote: >> There are several ways you can do it, but they generally fall into two >> classes of activies: >> >> (1) Modifying the name space exclusion assumption for jails, so that the >> file system name spaces overlap. One way to do this is with nullfs. >> >> (2) Having a daemon or tool that runs outside of the jail and brokers >> communication between the jails. One example might be a daemon that >> inserts a UNIX domain socket into both jails and then provides >> references to shared IPC objects between the two "by request". >> Another example might be a daemon or tool that responds to a request >> and creates a hard link from a socket/fifo endpoint visible in one >> jail to a name visible in another jail, perhaps when setting up the >> jail. The former requires more infrastructure, but the latter is less >> flexible. > > The jail(8) man page says that if the MIB > security.jail.sysvipc_allowed=1 processes inside a jail can use IPC to > talk to stuff in other jails. How does that affect mysql in a jail? Do I > need this enabled to run mysql? Last I checked, MySQL used solely TCP and UNIX domain sockets for communication, and not System V IPC. I believe PostgreSQL, however, used System V IPC. Robert N M Watson