Kernel RFC introduces cells as single hardened container objects

Josef Bacik has posted a third RFC for a large Linux kernel series that adds cells: a single kernel object meant to stand for one container with boundaries stricter than the usual mix of namespaces, cgroups, and capabilities.

A cell is built and sealed from the outside. The builder hands it a mount tree, an optional network namespace, a cgroup budget, and an explicit list of capabilities. Once sealed, uid 0 inside the cell holds none of those capabilities unless they were named in the caps slot; the bounding set can be reduced without CAP_SETPCAP, and file capabilities are ignored. Peer credentials and security labels on sockets refuse to cross the cell boundary, returning an error rather than a nobody identity that could be mistaken for a legitimate peer.

Several classic container-to-host paths are closed at the source. The host no longer runs usermode helpers (modprobe, request-key) or core-dump programs for a task that belongs to a cell, so a container cannot load arbitrary modules or feed memory contents to a privileged host binary. Core dumps to pipes or sockets are skipped silently. Seccomp user notifiers that remain outside the cell can still answer syscalls, but they are blocked from installing host file descriptors into the confined task.

Networking follows the same outside-in model. The network is prepared by the builder and attached, or left empty. An empty slot yields no network beyond Unix sockets; ordinary socket creation fails and network-wide ioctls are refused even on a handed-in socket. Where limited configuration inside the cell is wanted, a new net-rights mechanism replaces the all-or-nothing CAP_NET_ADMIN check, so a cell can be given only the specific rights (addresses, routes, filters, tun devices, and so on) that its workload needs.

Spawning can place the new task into a cgroup at or below the cell's budget, which is enough for a cell that runs systemd, and the cell may create further cgroups under that budget without altering the limits themselves. The series ships documentation and examples and is framed as an RFC on top of related credentials work.

If adopted, cells would give runtimes a kernel-native container object whose isolation properties are fixed at creation time rather than assembled from many separately configurable pieces that have repeatedly proven leaky.