I would still be in strong support of a cgroup replacement for NPROC rlimit. On Apr 20, 2014 7:29 AM, "Richard Davies" <richard@xxxxxxxxxxxx> wrote: > Vladimir Davydov wrote: > > Richard Davies wrote: > > > I have a simple reproducible test case in which untar in a memcg with a > > > kmem limit gets into trouble during heavy disk i/o (on ext3) and never > > > properly recovers. This is simplified from real world problems with > > > heavy disk i/o inside containers. > > > > Unfortunately, work on per cgroup kmem limits is not completed yet. > > Currently it lacks kmem reclaim on per cgroup memory pressure, which is > > vital for using kmem limits in real life. > ... > > In short, kmem limiting for memory cgroups is currently broken. Do not > > use it. We are working on making it usable though. > > Thanks for explaining the strange errors I got. > > > My motivation is to prevent a fork bomb in a container from affecting other > processes outside that container. > > kmem limits were the preferred mechanism in several previous discussions > about two years ago (I'm copying in participants from those previous > discussions and give links below). So I tried kmem first but found bugs. > > > What is the best mechanism available today, until kmem limits mature? > > RLIMIT_NPROC exists but is per-user, not per-container. > > Perhaps there is an up-to-date task counter patchset or similar? > > > Thank you all, > > Richard. > > > > Some references to previous discussions: > > Fork bomb limitation in memcg WAS: Re: [PATCH 00/11] kmem controller for > memcg: stripped down version > http://thread.gmane.org/gmane.linux.kernel/1318266/focus=1319372 > > Re: [PATCH 00/10] cgroups: Task counter subsystem v8 > http://thread.gmane.org/gmane.linux.kernel/1246704/focus=1467310 > > [RFD] Merge task counter into memcg > http://thread.gmane.org/gmane.linux.kernel/1280302 > > Re: [PATCH -mm] cgroup: Fix task counter common ancestor logic > http://thread.gmane.org/gmane.linux.kernel/1212650/focus=1220186 > > [PATCH] new cgroup controller "fork" > http://thread.gmane.org/gmane.linux.kernel/1210878 > > Re: Process Limit cgroups > http://thread.gmane.org/gmane.linux.kernel.cgroups/9368/focus=9369 > > Re: [lxc-devel] process number limit > https://www.mail-archive.com/lxc-devel@xxxxxxxxxxxxxxxxxxxxx/msg03309.html > _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
