I just discovered that
mount | grep cgroup returns nothing when you are not in the default network namespace. I can't really find any documentation on this except for that "network namespaces isolate the UNIX domain abstract socket namespace". That's in the man page for network namespaces.
Cgroups are mounted as type
cgroup. Is this a socket? Is that why they are unaccessible from a network namespace?
This is quite a limitation, because I cannot run things like
runc or any other program that uses cgroups in a specific network namespace.
Is there a way to work around this? Is this an intented feature? Documented anywhere?