In Docker we want to allow users to specify container specific sysctls, the problem we have is there is no way to figure out which sysctls are per namespace as opposed to which ones are for the entire system. We need a way to ask the kernel this, or to pass a flag to say fail to set it if this is a global sysctl.
what about a mount option to hide any sysctls that are not per namespace?
actually, scratch that, theres no real way to differentiate per-namespace vs global sysctls in the kernel. that information is codified in the code that stores/reads the sysctl data. I can keep looking at other ways to do this, but there may not be much hope here