From mboxrd@z Thu Jan 1 00:00:00 1970 From: Serge Hallyn Subject: Re: Protection against container fork bombs [WAS: Re: memcg with kmem limit doesn't recover after disk i/o causes limit to be hit] Date: Mon, 28 Apr 2014 18:00:25 +0000 Message-ID: <20140428180025.GC25689@ubuntumail> References: <20140416154650.GA3034@alpha.arachsys.com> <20140418155939.GE4523@dhcp22.suse.cz> <5351679F.5040908@parallels.com> <20140420142830.GC22077@alpha.arachsys.com> <20140422143943.20609800@oracle.com> <20140422200531.GA19334@alpha.arachsys.com> <535758A0.5000500@yuhu.biz> <20140423084942.560ae837@oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <20140423084942.560ae837-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Dwight Engen Cc: Richard Davies , Vladimir Davydov , Marian Marinov , Max Kellermann , Tim Hockin , Frederic Weisbecker , containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Daniel Walsh , cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Glauber Costa , Michal Hocko , linux-mm-Bw31MaZKKs3YtjvyW6yDsg@public.gmane.org, William Dauchy , Johannes Weiner , Tejun Heo , David Rientjes Quoting Dwight Engen (dwight.engen-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org): > On Wed, 23 Apr 2014 09:07:28 +0300 > Marian Marinov wrote: > > > On 04/22/2014 11:05 PM, Richard Davies wrote: > > > Dwight Engen wrote: > > >> Richard Davies wrote: > > >>> Vladimir Davydov wrote: > > >>>> In short, kmem limiting for memory cgroups is currently broken. > > >>>> Do not use it. We are working on making it usable though. > > > ... > > >>> What is the best mechanism available today, until kmem limits > > >>> mature? > > >>> > > >>> RLIMIT_NPROC exists but is per-user, not per-container. > > >>> > > >>> Perhaps there is an up-to-date task counter patchset or similar? > > >> > > >> I updated Frederic's task counter patches and included Max > > >> Kellermann's fork limiter here: > > >> > > >> http://thread.gmane.org/gmane.linux.kernel.containers/27212 > > >> > > >> I can send you a more recent patchset (against 3.13.10) if you > > >> would find it useful. > > > > > > Yes please, I would be interested in that. Ideally even against > > > 3.14.1 if you have that too. > > > > Dwight, do you have these patches in any public repo? > > > > I would like to test them also. > > Hi Marian, I put the patches against 3.13.11 and 3.14.1 up at: > > git://github.com/dwengen/linux.git cpuacct-task-limit-3.13 > git://github.com/dwengen/linux.git cpuacct-task-limit-3.14 Thanks, Dwight. FWIW I'm agreed with Tim, Dwight, Richard, and Marian that a task limit would be a proper cgroup extension, and specifically that approximating that with a kmem limit is not a reasonable substitute. -serge