From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Davies Subject: Re: Protection against container fork bombs [WAS: Re: memcg with kmem limit doesn't recover after disk i/o causes limit to be hit] Date: Tue, 22 Apr 2014 21:05:31 +0100 Message-ID: <20140422200531.GA19334@alpha.arachsys.com> References: <20140416154650.GA3034@alpha.arachsys.com> <20140418155939.GE4523@dhcp22.suse.cz> <5351679F.5040908@parallels.com> <20140420142830.GC22077@alpha.arachsys.com> <20140422143943.20609800@oracle.com> Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <20140422143943.20609800@oracle.com> Sender: owner-linux-mm@kvack.org List-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Dwight Engen Cc: Vladimir Davydov , Frederic Weisbecker , David Rientjes , Glauber Costa , Tejun Heo , Max Kellermann , Johannes Weiner , William Dauchy , Tim Hockin , Michal Hocko , Daniel Walsh , Daniel Berrange , cgroups@vger.kernel.org, containers@lists.linux-foundation.org, linux-mm@kvack.org Dwight Engen wrote: > Richard Davies wrote: > > Vladimir Davydov wrote: > > > In short, kmem limiting for memory cgroups is currently broken. Do > > > not use it. We are working on making it usable though. ... > > What is the best mechanism available today, until kmem limits mature? > > > > RLIMIT_NPROC exists but is per-user, not per-container. > > > > Perhaps there is an up-to-date task counter patchset or similar? > > I updated Frederic's task counter patches and included Max Kellermann's > fork limiter here: > > http://thread.gmane.org/gmane.linux.kernel.containers/27212 > > I can send you a more recent patchset (against 3.13.10) if you would > find it useful. Yes please, I would be interested in that. Ideally even against 3.14.1 if you have that too. Thanks, Richard. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org