cgroup pid controller side effects

cgroup pid controller side effects

[Robert Gierzinger]

Hi,
I have finally had time to test 4.3-rc5 especially (my greatly anticipated) process limitiation with cgroup-pids.
With bash forkbombs, it really works nice, however, I had some side effects with the forkbomb from
https://github.com/linux-vserver/util-vserver/blob/master/tests/forkbomb.c

The good thing: my test systems did not die as in previous versions during the simulated attack. But executing the file with e.g. 
./forkbomb 100000 100 fork
I get "unable to fork process: Resource temporarily unavailable" on the host (e.g. while trying to have a look via "watch -n 2 cat /sys/fs/cgroup/pids/lxc/dev04/pids.current") and inside other cgroup processes. This happens with various (low) limits in the respective pids.max; also it doesn't matter whether to launch the forkbomb in a privileged or unprivileged/user-namespace cgroup.

Maybe someone could have a look, please, as this would be a real nice feature for a hosting service.
And thanks for your great work!

Best regards,

Robert

Re: cgroup pid controller side effects

[Johannes Weiner]

Hi Robert,

On Thu, Oct 15, 2015 at 04:13:02PM +0200, Robert Gierzinger wrote:
> I have finally had time to test 4.3-rc5 especially (my greatly anticipated) process limitiation with cgroup-pids.
> With bash forkbombs, it really works nice, however, I had some side effects with the forkbomb from
> https://github.com/linux-vserver/util-vserver/blob/master/tests/forkbomb.c
> 
> The good thing: my test systems did not die as in previous versions during the simulated attack. But executing the file with e.g. 
> ./forkbomb 100000 100 fork
> I get "unable to fork process: Resource temporarily unavailable" on the host

It looks like this forkbomb is not waiting for its children and is
creating a whole lot of zombies.

The pids controller is currently broken in that zombies can escape
accounting completely, and the proposed fix is too invasive to go in
before 4.4. Until then, we need forkbombs to nicely cooperate with us!

Could you retry your test against the following branch?

https://git.kernel.org/cgit/linux/kernel/git/tj/cgroup.git/log/?h=for-4.4

Thanks!
Johannes

Re: cgroup pid controller side effects

[Robert Gierzinger]

 
On Friday, October 16, 2015 19:39 CEST, Johannes Weiner <hannes-druUgvl0LCNAfugRpC6u6w@public.gmane.org> wrote: 
> Could you retry your test against the following branch?
> 
> https://git.kernel.org/cgit/linux/kernel/git/tj/cgroup.git/log/?h=for-4.4

Nice! This seems to work great, yummy! The system behaves as expected, I did some tests on a virtual 4-core machine with root cgroups, user cgroups executing shell and the mentioned c-forkbomb with up to 5k procs per cgroup. Even under parallel "attack" within several groups the other process groups just worked fine. 

Thanks for the great work!

Robert