• Eric Dumazet's avatar
    net: do not create fallback tunnels for non-default namespaces · 79134e6c
    Eric Dumazet authored
    fallback tunnels (like tunl0, gre0, gretap0, erspan0, sit0,
    ip6tnl0, ip6gre0) are automatically created when the corresponding
    module is loaded.
    
    These tunnels are also automatically created when a new network
    namespace is created, at a great cost.
    
    In many cases, netns are used for isolation purposes, and these
    extra network devices are a waste of resources. We are using
    thousands of netns per host, and hit the netns creation/delete
    bottleneck a lot. (Many thanks to Kirill for recent work on this)
    
    Add a new sysctl so that we can opt-out from this automatic creation.
    
    Note that these tunnels are still created for the initial namespace,
    to be the least intrusive for typical setups.
    
    Tested:
    lpk43:~# cat add_del_unshare.sh
    for i in `seq 1 40`
    do
     (for j in `seq 1 100` ; do  unshare -n /bin/true >/dev/null ; done) &
    done
    wait
    
    lpk43:~# echo 0 >/proc/sys/net/core/fb_tunnels_only_for_init_net
    lpk43:~# time ./add_del_unshare.sh
    
    real	0m37.521s
    user	0m0.886s
    sys	7m7.084s
    lpk43:~# echo 1 >/proc/sys/net/core/fb_tunnels_only_for_init_net
    lpk43:~# time ./add_del_unshare.sh
    
    real	0m4.761s
    user	0m0.851s
    sys	1m8.343s
    lpk43:~#
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    79134e6c
ip_tunnel.c 28.4 KB