On Wed 01-06-22 07:22:05, Roman Gushchin wrote: > On Wed, Jun 01, 2022 at 03:05:34PM +0200, Michal Hocko wrote: > > On Wed 01-06-22 11:32:26, Michal Hocko wrote: > > > On Wed 01-06-22 11:15:43, Michal Koutny wrote: > > > > On Wed, Jun 01, 2022 at 06:43:27AM +0300, Vasily Averin <vvs@xxxxxxxxxx> wrote: > > > > > CT-901 /# cat /sys/fs/cgroup/memory/cgroup.subgroups_limit > > > > > 512 > > > > > CT-901 /# echo 3333 > /sys/fs/cgroup/memory/cgroup.subgroups_limit > > > > > -bash: echo: write error: Operation not permitted > > > > > CT-901 /# echo 333 > /sys/fs/cgroup/memory/cgroup.subgroups_limit > > > > > -bash: echo: write error: Operation not permitted > > > > > > > > > > I doubt this way can be accepted in upstream, however for OpenVz > > > > > something like this it is mandatory because it much better > > > > > than nothing. > > > > > > > > Is this customization of yours something like cgroup.max.descendants on > > > > the unified (v2) hierarchy? (Just curious.) > > > > > > > > (It can be made inaccessible from within the subtree either with cgroup > > > > ns or good old FS permissions.) > > > > > > So we already do have a limit to prevent somebody from running away with > > > the number of cgroups. Nice! > > Yes, we do! > > > > I was not aware of that and I guess this > > > looks like the right thing to do. So do we need more control and > > > accounting that this? > > > > I have checked the actual implementation and noticed that cgroups are > > uncharged when offlined (rmdir-ed) which means that an adversary could > > still trick the limit and runaway while still consuming resources. > > > > Roman, I guess the reason for this implementation was to avoid limit to > > trigger on setups with memcgs which can take quite some time to die? > > Would it make sense to make the implementation more strict to really act > > as gate against potential cgroups count runways? > > The reasoning was that in many cases a user can't do much about dying cgroups, > so it's not clear how they should/would handle getting -EAGAIN on creating a > new cgroup (retrying will not help, obviously). Live cgroups can be easily > deleted, dying cgroups - not always. > > I'm not sure about switching the semantics. I'd wait till Muchun's lru page > reparenting will be landed (could be within 1-2 releases, I guess) and then we > can check whether the whole problem is mostly gone. Honestly, I think we might > need to fix few another things, but it might be not that hard (in comparison > to what we already did). OK, thanks for the confirmation! Say we end up mitigating the too-easy-to-linger memcgs long standing issue. Do we still need an extended cgroup data structure accounting? -- Michal Hocko SUSE Labs
