Alexander Lvov 81784bfbac contain: add core scheduling support (PR_SCHED_CORE) ...

Adds --use_core_scheduling proto flag that calls prctl(PR_SCHED_CORE_CREATE) in the child process, giving each jail its own SMT scheduling group. Prevents sharing a physical core with other tenants and mitigates L1TF/MDS side-channel attacks in multi-tenant environments. Requires Linux >= 5.14; guarded with #ifdef PR_SCHED_CORE for compatibility with older kernel headers.

2026-06-11 10:33:53 +03:00

14 KiB

Raw Blame History

View Raw