Subject: Re: [PATCH 00/12] add namespace support for netfilter protos

From: Pablo Neira Ayuso <[email-masked]>
Date: Tue, 17 Apr 2012 12:59:00 +0200

On Tue, Apr 17, 2012 at 12:34:48PM +0200, Jan Engelhardt wrote:
> 
> On Tuesday 2012-04-17 04:56, Gao feng wrote:
> 
> >Currently the sysctl of netfilter proto is not isolated, so when 
> >changing proto's sysctl in container will cause the host's sysctl 
> >be changed too. it's not expected.
> 
> I wonder if it made sense to do the configuration of NFCT via
> netlink as well, and deprecate the sysctl interface.

Good point Jan.

However, we're in inconsistent state now and removing interfaces is
not easy / fast.

So I think we have to fix it first and then, if we decide to do so,
deprecate them.

It seems to me like a good idea to target to providing netlink
interfaces for all netfilter tweaks and use iptables (or whatsoever.
command line tool we'll have in the future) to attach specific
configurations to flow.

Thus, having no more sysctl stuff and module parameters tweaks.