{"action":"created","issue":{"url":"https://api.github.com/repos/opencontainers/specs/issues/345","repository_url":"https://api.github.com/repos/opencontainers/specs","labels_url":"https://api.github.com/repos/opencontainers/specs/issues/345/labels{/name}","comments_url":"https://api.github.com/repos/opencontainers/specs/issues/345/comments","events_url":"https://api.github.com/repos/opencontainers/specs/issues/345/events","html_url":"https://github.com/opencontainers/specs/issues/345","id":141379590,"number":345,"title":"Exec semantics","user":{"login":"vishh","id":7063592,"avatar_url":"https://avatars.githubusercontent.com/u/7063592?v=3","gravatar_id":"","url":"https://api.github.com/users/vishh","html_url":"https://github.com/vishh","followers_url":"https://api.github.com/users/vishh/followers","following_url":"https://api.github.com/users/vishh/following{/other_user}","gists_url":"https://api.github.com/users/vishh/gists{/gist_id}","starred_url":"https://api.github.com/users/vishh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vishh/subscriptions","organizations_url":"https://api.github.com/users/vishh/orgs","repos_url":"https://api.github.com/users/vishh/repos","events_url":"https://api.github.com/users/vishh/events{/privacy}","received_events_url":"https://api.github.com/users/vishh/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2016-03-16T19:37:20Z","updated_at":"2016-03-17T18:31:13Z","closed_at":null,"body":"The current Spec attempts to express `exec` functionality by splitting the container into a sandbox and a process. This split fails to address some of the use cases like as follows - \r\n1. Imposing additional resource restrictions on the exec process.\r\n2. Imposing alternate/additional security policy on the exec process.\r\n\r\nIt is proving to be difficult to represent all the use cases and also preserve the semantics around the sandbox and the process.\r\nHave we considered representing `exec` as a separate container with a process? That separate container can share some parts of the existing container's sandbox.\r\nIIRC, the Spec tried to represent `exec` as a separate container in the beginning, but I cannot recall when it diverged from the original plan.\r\n\r\ncc @crosbymichael @mrunalp "},"comment":{"url":"https://api.github.com/repos/opencontainers/specs/issues/comments/198021422","html_url":"https://github.com/opencontainers/specs/issues/345#issuecomment-198021422","issue_url":"https://api.github.com/repos/opencontainers/specs/issues/345","id":198021422,"user":{"login":"duglin","id":1944671,"avatar_url":"https://avatars.githubusercontent.com/u/1944671?v=3","gravatar_id":"","url":"https://api.github.com/users/duglin","html_url":"https://github.com/duglin","followers_url":"https://api.github.com/users/duglin/followers","following_url":"https://api.github.com/users/duglin/following{/other_user}","gists_url":"https://api.github.com/users/duglin/gists{/gist_id}","starred_url":"https://api.github.com/users/duglin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/duglin/subscriptions","organizations_url":"https://api.github.com/users/duglin/orgs","repos_url":"https://api.github.com/users/duglin/repos","events_url":"https://api.github.com/users/duglin/events{/privacy}","received_events_url":"https://api.github.com/users/duglin/received_events","type":"User","site_admin":false},"created_at":"2016-03-17T18:31:13Z","updated_at":"2016-03-17T18:31:13Z","body":"@mrunalp do you mean expose it as \"runc exec ..\" but under the covers do some kind of \"join\" to the existing namespaces/etc... ?"}}