Protection against container fork bombs [WAS: Re: memcg with kmem limit doesn't recover after disk i/o causes limit to be hit]

[Tim Hockin]

I would still be in strong support of a cgroup replacement for NPROC rlimit.
On Apr 20, 2014 7:29 AM, "Richard Davies" <richard at arachsys.com> wrote:

> Vladimir Davydov wrote:
> > Richard Davies wrote:
> > > I have a simple reproducible test case in which untar in a memcg with a
> > > kmem limit gets into trouble during heavy disk i/o (on ext3) and never
> > > properly recovers. This is simplified from real world problems with
> > > heavy disk i/o inside containers.
> >
> > Unfortunately, work on per cgroup kmem limits is not completed yet.
> > Currently it lacks kmem reclaim on per cgroup memory pressure, which is
> > vital for using kmem limits in real life.
> ...
> > In short, kmem limiting for memory cgroups is currently broken. Do not
> > use it. We are working on making it usable though.
>
> Thanks for explaining the strange errors I got.
>
>
> My motivation is to prevent a fork bomb in a container from affecting other
> processes outside that container.
>
> kmem limits were the preferred mechanism in several previous discussions
> about two years ago (I'm copying in participants from those previous
> discussions and give links below). So I tried kmem first but found bugs.
>
>
> What is the best mechanism available today, until kmem limits mature?
>
> RLIMIT_NPROC exists but is per-user, not per-container.
>
> Perhaps there is an up-to-date task counter patchset or similar?
>
>
> Thank you all,
>
> Richard.
>
>
>
> Some references to previous discussions:
>
> Fork bomb limitation in memcg WAS: Re: [PATCH 00/11] kmem controller for
> memcg: stripped down version
> http://thread.gmane.org/gmane.linux.kernel/1318266/focus=1319372
>
> Re: [PATCH 00/10] cgroups: Task counter subsystem v8
> http://thread.gmane.org/gmane.linux.kernel/1246704/focus=1467310
>
> [RFD] Merge task counter into memcg
> http://thread.gmane.org/gmane.linux.kernel/1280302
>
> Re: [PATCH -mm] cgroup: Fix task counter common ancestor logic
> http://thread.gmane.org/gmane.linux.kernel/1212650/focus=1220186
>
> [PATCH] new cgroup controller "fork"
> http://thread.gmane.org/gmane.linux.kernel/1210878
>
> Re: Process Limit cgroups
> http://thread.gmane.org/gmane.linux.kernel.cgroups/9368/focus=9369
>
> Re: [lxc-devel] process number limit
> https://www.mail-archive.com/lxc-devel@lists.sourceforge.net/msg03309.html
>