Hello, Frederic. On Thu, Apr 12, 2012 at 06:59:27PM +0200, Frederic Weisbecker wrote: > I want: > > a) to prevent the forkbomb from going far enough to DDOS the machine > b) to be able to kill that forkbomb once detected, in one go without race > against concurrent forks. > > I think a) can work just fine with kernel stack limiting. I also need > to be notified about the fact we reached the limit. And b) should > be feasible with the help of the cgroup freezer. kmem allocation fail after reaching the limit which in turn should fail task creation. Isn't that the same effect as the task_counter as implemented? > > Is there anything for which you need to know exactly the number of > > processes? > > No that's really about prevent/kill forkbomb as far as I'm concerned. Hmm... so, accounting overhead aside, if the only purpose is preventing the whole machine being brought down by a fork bomb, kmem limiting is enough, right? Thanks. -- tejun _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
