On Tue, Apr 17, 2012 at 08:17:53AM -0700, Tejun Heo wrote: > Hello, Frederic. > > On Thu, Apr 12, 2012 at 06:59:27PM +0200, Frederic Weisbecker wrote: > > I want: > > > > a) to prevent the forkbomb from going far enough to DDOS the machine > > b) to be able to kill that forkbomb once detected, in one go without race > > against concurrent forks. > > > > I think a) can work just fine with kernel stack limiting. I also need > > to be notified about the fact we reached the limit. And b) should > > be feasible with the help of the cgroup freezer. > > kmem allocation fail after reaching the limit which in turn should > fail task creation. Isn't that the same effect as the task_counter as > implemented? That's it. > > > > Is there anything for which you need to know exactly the number of > > > processes? > > > > No that's really about prevent/kill forkbomb as far as I'm concerned. > > Hmm... so, accounting overhead aside, if the only purpose is > preventing the whole machine being brought down by a fork bomb, kmem > limiting is enough, right? I think so yeah. _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
