{"action":"created","comment":{"url":"https://api.github.com/repos/appc/spec/pulls/comments/24551587","id":24551587,"diff_hunk":"@@ -201,25 +201,157 @@ Note that logging mechanisms other than stdout and stderr are not required by th\n ### Isolators\n \n Isolators enforce resource constraints rather than namespacing.\n-Isolators may be applied to individual applications, to whole containers, or to both.\n+Isolators may be scoped to individual applications, to whole containers, or to both.\n Some well known isolators can be verified by the specification.\n Additional isolators will be added to this specification over time.\n \n-|Name|Type|Schema|Example|\n-|---------------------------|------|------------------------------------|------------------------------------|\n-|cpu/shares                 |string|\"&lt;uint&gt;\"                      |\"4096\"                              |\n-|memory/limit               |string|\"&lt;bytes&gt;\"                     |\"1G\", \"5T\", \"4K\"                    |\n-|cpu/mask                   |string|\"&lt;cpu range&gt;\"                 |\"0\", \"0-3\", \"0,2,4-7\"               |\n-|block-io/read-bandwidth    |string|\"&lt;path to file&gt; &lt;bytes&gt;\"|\"/tmp 1K\"                           |\n-|block-io/write-bandwidth   |string|\"&lt;path to file&gt; &lt;bytes&gt;\"|\"/tmp 1K\"                           |\n-|network-io/read-bandwidth  |string|\"&lt;device name&gt; &lt;bytes&gt;\" |\"eth0 100M\"                         |\n-|network-io/write-bandwidth |string|\"&lt;device name&gt; &lt;bytes&gt;\" |\"eth0 100M\"                         |\n-|capabilities/bounding-set  |string|\"&lt;cap&gt; &lt;cap&gt; ...\"       |\"CAP_NET_BIND_SERVICE CAP_SYS_ADMIN\"|\n+An isolator is a standalone JSON object with only one required field: \"name\".\n+All other fields are specific to the isolator.\n \n-#### Types\n+An executor MAY ignore isolators that it does not understand and run the container without them.\n+But, an executor MUST notify the user of the isolators that were ignored during the run.\n+An executor MAY implement a \"strict mode\" where an image cannot run unless all isolators are in place.\n \n-* uint: base 10 formatted unsigned int as a string\n-* bytes: Suffix to a base 10 int to make it a K, M, G, or T for base 1024\n+### Linux Isolators\n+\n+These isolators are specific to the Linux Kernel and are impossible to represent as a 1-to-1 mapping on other Kernels.\n+The first example is \"capabilities\" but this will be expanded to include things such as SELinux, SMACK or AppArmor.\n+\n+#### linux/capabilities-remove-set\n+\n+* Scope: app\n+\n+**Parameters:**\n+* **set** list of capabilities that will be removed from the processes's capabilities bounding set\n+\n+```\n+\"name\": \"linux/capabilities-remove-set\",\n+\"set\": [\n+\t\"CAP_SYS_PTRACE\",\n+]\n+```\n+\n+#### linux/capabilities-retain-set\n+\n+* Scope: app\n+\n+**Parameters:**\n+* **set** list of capabilities that will be retained in the processes's capabilities bounding set\n+\n+```\n+\"name\": \"linux/capabilities-retain-set\",\n+\"set\": [\n+\t\"CAP_KILL\",\n+\t\"CAP_CHOWN\"\n+]\n+```\n+\n+### Resource Isolators\n+\n+#### resource/cpu\n+\n+* Scope: app/container\n+\n+**Parameters:**\n+* **request** milli-cores that are requested\n+* **limit** milli-cores that can be consumed before the Kernel unschedules\n+\n+```\n+\"name\": \"resource/cpu\",\n+\"request\": \"250\",\n+\"limit\": \"500\"\n+```\n+\n+**Note**: a milli-core is the milli-seconds/second that the app will be able to run. e.g. 1000 would represent full use of a single CPU core.\n+\n+#### resource/memory\n+\n+* Scope: app/container\n+\n+**Parameters:**\n+* **request** bytes of memory that the app is requesting to use and will be pushed back to as a result of contention\n+* **limit** bytes of memory that the app can allocate before the Kernel stops allowing allocations\n+\n+```\n+\"name\": \"resource/memory\",\n+\"request\": \"1G\",\n+\"limit\": \"2G\"\n+```\n+\n+#### resource/block-weight\n+\n+* Scope: app/container\n+\n+**Parameters:**\n+* **devicePaths** the block devices that this weight will be placed on, if this is omitted then this weight will be the default for all devices","path":"SPEC.md","position":100,"original_position":100,"commit_id":"d6b759dabb82e7d567c9b68e007f38d07422d7e8","original_commit_id":"d6b759dabb82e7d567c9b68e007f38d07422d7e8","user":{"login":"jonboulle","id":2601015,"avatar_url":"https://avatars.githubusercontent.com/u/2601015?v=3","gravatar_id":"","url":"https://api.github.com/users/jonboulle","html_url":"https://github.com/jonboulle","followers_url":"https://api.github.com/users/jonboulle/followers","following_url":"https://api.github.com/users/jonboulle/following{/other_user}","gists_url":"https://api.github.com/users/jonboulle/gists{/gist_id}","starred_url":"https://api.github.com/users/jonboulle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonboulle/subscriptions","organizations_url":"https://api.github.com/users/jonboulle/orgs","repos_url":"https://api.github.com/users/jonboulle/repos","events_url":"https://api.github.com/users/jonboulle/events{/privacy}","received_events_url":"https://api.github.com/users/jonboulle/received_events","type":"User","site_admin":false},"body":"what if it's omitted but others are specified per-device?","created_at":"2015-02-12T01:28:03Z","updated_at":"2015-02-12T01:28:03Z","html_url":"https://github.com/appc/spec/pull/192#discussion_r24551587","pull_request_url":"https://api.github.com/repos/appc/spec/pulls/192","_links":{"self":{"href":"https://api.github.com/repos/appc/spec/pulls/comments/24551587"},"html":{"href":"https://github.com/appc/spec/pull/192#discussion_r24551587"},"pull_request":{"href":"https://api.github.com/repos/appc/spec/pulls/192"}}},"pull_request":{"url":"https://api.github.com/repos/appc/spec/pulls/192","id":29069796,"html_url":"https://github.com/appc/spec/pull/192","diff_url":"https://github.com/appc/spec/pull/192.diff","patch_url":"https://github.com/appc/spec/pull/192.patch","issue_url":"https://api.github.com/repos/appc/spec/issues/192","number":192,"state":"open","locked":false,"title":"SPEC: make isolators objects instead of strings","user":{"login":"philips","id":33544,"avatar_url":"https://avatars.githubusercontent.com/u/33544?v=3","gravatar_id":"","url":"https://api.github.com/users/philips","html_url":"https://github.com/philips","followers_url":"https://api.github.com/users/philips/followers","following_url":"https://api.github.com/users/philips/following{/other_user}","gists_url":"https://api.github.com/users/philips/gists{/gist_id}","starred_url":"https://api.github.com/users/philips/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philips/subscriptions","organizations_url":"https://api.github.com/users/philips/orgs","repos_url":"https://api.github.com/users/philips/repos","events_url":"https://api.github.com/users/philips/events{/privacy}","received_events_url":"https://api.github.com/users/philips/received_events","type":"User","site_admin":false},"body":"Until now isolators have not had a schema and had to be serialized to a\r\nstring. Fix this by making an isolator an object with only a single\r\nrequired field: \"name\". Everything else goes into isolator specific\r\nfields.\r\n\r\nCredits and influences:\r\n\r\nhttp://www.freedesktop.org/software/systemd/man/systemd.exec.html#CapabilityBoundingSet=\r\nhttps://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/resources.md\r\nhttps://github.com/google/lmctfy/blob/master/include/lmctfy.proto\r\nhttps://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt\r\nhttps://www.kernel.org/doc/Documentation/cgroups/net_cls.txt\r\nhttps://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt","created_at":"2015-02-11T05:56:23Z","updated_at":"2015-02-12T01:28:03Z","closed_at":null,"merged_at":null,"merge_commit_sha":"d07e20b12ab757bf810d7b0b7013c4c8df08fb13","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/appc/spec/pulls/192/commits","review_comments_url":"https://api.github.com/repos/appc/spec/pulls/192/comments","review_comment_url":"https://api.github.com/repos/appc/spec/pulls/comments/{number}","comments_url":"https://api.github.com/repos/appc/spec/issues/192/comments","statuses_url":"https://api.github.com/repos/appc/spec/statuses/d6b759dabb82e7d567c9b68e007f38d07422d7e8","head":{"label":"philips:isolators-as-objects","ref":"isolators-as-objects","sha":"d6b759dabb82e7d567c9b68e007f38d07422d7e8","user":{"login":"philips","id":33544,"avatar_url":"https://avatars.githubusercontent.com/u/33544?v=3","gravatar_id":"","url":"https://api.github.com/users/philips","html_url":"https://github.com/philips","followers_url":"https://api.github.com/users/philips/followers","following_url":"https://api.github.com/users/philips/following{/other_user}","gists_url":"https://api.github.com/users/philips/gists{/gist_id}","starred_url":"https://api.github.com/users/philips/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philips/subscriptions","organizations_url":"https://api.github.com/users/philips/orgs","repos_url":"https://api.github.com/users/philips/repos","events_url":"https://api.github.com/users/philips/events{/privacy}","received_events_url":"https://api.github.com/users/philips/received_events","type":"User","site_admin":false},"repo":{"id":28165005,"name":"spec","full_name":"philips/spec","owner":{"login":"philips","id":33544,"avatar_url":"https://avatars.githubusercontent.com/u/33544?v=3","gravatar_id":"","url":"https://api.github.com/users/philips","html_url":"https://github.com/philips","followers_url":"https://api.github.com/users/philips/followers","following_url":"https://api.github.com/users/philips/following{/other_user}","gists_url":"https://api.github.com/users/philips/gists{/gist_id}","starred_url":"https://api.github.com/users/philips/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philips/subscriptions","organizations_url":"https://api.github.com/users/philips/orgs","repos_url":"https://api.github.com/users/philips/repos","events_url":"https://api.github.com/users/philips/events{/privacy}","received_events_url":"https://api.github.com/users/philips/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/philips/spec","description":"App Container Specification and Tooling","fork":true,"url":"https://api.github.com/repos/philips/spec","forks_url":"https://api.github.com/repos/philips/spec/forks","keys_url":"https://api.github.com/repos/philips/spec/keys{/key_id}","collaborators_url":"https://api.github.com/repos/philips/spec/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/philips/spec/teams","hooks_url":"https://api.github.com/repos/philips/spec/hooks","issue_events_url":"https://api.github.com/repos/philips/spec/issues/events{/number}","events_url":"https://api.github.com/repos/philips/spec/events","assignees_url":"https://api.github.com/repos/philips/spec/assignees{/user}","branches_url":"https://api.github.com/repos/philips/spec/branches{/branch}","tags_url":"https://api.github.com/repos/philips/spec/tags","blobs_url":"https://api.github.com/repos/philips/spec/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/philips/spec/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/philips/spec/git/refs{/sha}","trees_url":"https://api.github.com/repos/philips/spec/git/trees{/sha}","statuses_url":"https://api.github.com/repos/philips/spec/statuses/{sha}","languages_url":"https://api.github.com/repos/philips/spec/languages","stargazers_url":"https://api.github.com/repos/philips/spec/stargazers","contributors_url":"https://api.github.com/repos/philips/spec/contributors","subscribers_url":"https://api.github.com/repos/philips/spec/subscribers","subscription_url":"https://api.github.com/repos/philips/spec/subscription","commits_url":"https://api.github.com/repos/philips/spec/commits{/sha}","git_commits_url":"https://api.github.com/repos/philips/spec/git/commits{/sha}","comments_url":"https://api.github.com/repos/philips/spec/comments{/number}","issue_comment_url":"https://api.github.com/repos/philips/spec/issues/comments/{number}","contents_url":"https://api.github.com/repos/philips/spec/contents/{+path}","compare_url":"https://api.github.com/repos/philips/spec/compare/{base}...{head}","merges_url":"https://api.github.com/repos/philips/spec/merges","archive_url":"https://api.github.com/repos/philips/spec/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/philips/spec/downloads","issues_url":"https://api.github.com/repos/philips/spec/issues{/number}","pulls_url":"https://api.github.com/repos/philips/spec/pulls{/number}","milestones_url":"https://api.github.com/repos/philips/spec/milestones{/number}","notifications_url":"https://api.github.com/repos/philips/spec/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/philips/spec/labels{/name}","releases_url":"https://api.github.com/repos/philips/spec/releases{/id}","created_at":"2014-12-18T02:28:31Z","updated_at":"2014-12-18T02:28:33Z","pushed_at":"2015-02-11T23:03:00Z","git_url":"git://github.com/philips/spec.git","ssh_url":"git@github.com:philips/spec.git","clone_url":"https://github.com/philips/spec.git","svn_url":"https://github.com/philips/spec","homepage":null,"size":880,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"appc:master","ref":"master","sha":"dcbbf95f2dcf025d34994843dcab71ec728cf79b","user":{"login":"appc","id":10080092,"avatar_url":"https://avatars.githubusercontent.com/u/10080092?v=3","gravatar_id":"","url":"https://api.github.com/users/appc","html_url":"https://github.com/appc","followers_url":"https://api.github.com/users/appc/followers","following_url":"https://api.github.com/users/appc/following{/other_user}","gists_url":"https://api.github.com/users/appc/gists{/gist_id}","starred_url":"https://api.github.com/users/appc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/appc/subscriptions","organizations_url":"https://api.github.com/users/appc/orgs","repos_url":"https://api.github.com/users/appc/repos","events_url":"https://api.github.com/users/appc/events{/privacy}","received_events_url":"https://api.github.com/users/appc/received_events","type":"Organization","site_admin":false},"repo":{"id":27782596,"name":"spec","full_name":"appc/spec","owner":{"login":"appc","id":10080092,"avatar_url":"https://avatars.githubusercontent.com/u/10080092?v=3","gravatar_id":"","url":"https://api.github.com/users/appc","html_url":"https://github.com/appc","followers_url":"https://api.github.com/users/appc/followers","following_url":"https://api.github.com/users/appc/following{/other_user}","gists_url":"https://api.github.com/users/appc/gists{/gist_id}","starred_url":"https://api.github.com/users/appc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/appc/subscriptions","organizations_url":"https://api.github.com/users/appc/orgs","repos_url":"https://api.github.com/users/appc/repos","events_url":"https://api.github.com/users/appc/events{/privacy}","received_events_url":"https://api.github.com/users/appc/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/appc/spec","description":"App Container Specification and Tooling","fork":false,"url":"https://api.github.com/repos/appc/spec","forks_url":"https://api.github.com/repos/appc/spec/forks","keys_url":"https://api.github.com/repos/appc/spec/keys{/key_id}","collaborators_url":"https://api.github.com/repos/appc/spec/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/appc/spec/teams","hooks_url":"https://api.github.com/repos/appc/spec/hooks","issue_events_url":"https://api.github.com/repos/appc/spec/issues/events{/number}","events_url":"https://api.github.com/repos/appc/spec/events","assignees_url":"https://api.github.com/repos/appc/spec/assignees{/user}","branches_url":"https://api.github.com/repos/appc/spec/branches{/branch}","tags_url":"https://api.github.com/repos/appc/spec/tags","blobs_url":"https://api.github.com/repos/appc/spec/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/appc/spec/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/appc/spec/git/refs{/sha}","trees_url":"https://api.github.com/repos/appc/spec/git/trees{/sha}","statuses_url":"https://api.github.com/repos/appc/spec/statuses/{sha}","languages_url":"https://api.github.com/repos/appc/spec/languages","stargazers_url":"https://api.github.com/repos/appc/spec/stargazers","contributors_url":"https://api.github.com/repos/appc/spec/contributors","subscribers_url":"https://api.github.com/repos/appc/spec/subscribers","subscription_url":"https://api.github.com/repos/appc/spec/subscription","commits_url":"https://api.github.com/repos/appc/spec/commits{/sha}","git_commits_url":"https://api.github.com/repos/appc/spec/git/commits{/sha}","comments_url":"https://api.github.com/repos/appc/spec/comments{/number}","issue_comment_url":"https://api.github.com/repos/appc/spec/issues/comments/{number}","contents_url":"https://api.github.com/repos/appc/spec/contents/{+path}","compare_url":"https://api.github.com/repos/appc/spec/compare/{base}...{head}","merges_url":"https://api.github.com/repos/appc/spec/merges","archive_url":"https://api.github.com/repos/appc/spec/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/appc/spec/downloads","issues_url":"https://api.github.com/repos/appc/spec/issues{/number}","pulls_url":"https://api.github.com/repos/appc/spec/pulls{/number}","milestones_url":"https://api.github.com/repos/appc/spec/milestones{/number}","notifications_url":"https://api.github.com/repos/appc/spec/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/appc/spec/labels{/name}","releases_url":"https://api.github.com/repos/appc/spec/releases{/id}","created_at":"2014-12-09T19:17:54Z","updated_at":"2015-02-12T01:13:19Z","pushed_at":"2015-02-11T23:31:00Z","git_url":"git://github.com/appc/spec.git","ssh_url":"git@github.com:appc/spec.git","clone_url":"https://github.com/appc/spec.git","svn_url":"https://github.com/appc/spec","homepage":null,"size":2596,"stargazers_count":340,"watchers_count":340,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":39,"mirror_url":null,"open_issues_count":60,"forks":39,"open_issues":60,"watchers":340,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/appc/spec/pulls/192"},"html":{"href":"https://github.com/appc/spec/pull/192"},"issue":{"href":"https://api.github.com/repos/appc/spec/issues/192"},"comments":{"href":"https://api.github.com/repos/appc/spec/issues/192/comments"},"review_comments":{"href":"https://api.github.com/repos/appc/spec/pulls/192/comments"},"review_comment":{"href":"https://api.github.com/repos/appc/spec/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/appc/spec/pulls/192/commits"},"statuses":{"href":"https://api.github.com/repos/appc/spec/statuses/d6b759dabb82e7d567c9b68e007f38d07422d7e8"}}}}