Plumbers'15 talk

1. Cgroups kernel
memory controller
Cgroups kernel
memory controller
Pavel Emelyanov
Containers MC, Linux Plumbers, Seattle, 2015

2. DisclaimerDisclaimer
/me is not actively involved in the
development
All-tech-questions-to: Vladimir Davydov
<vdavydov@odin.com>
2

3. WhatWhat
Extention to the memcg
that accounts (and limits) kernel memory
3

4. What forWhat for
• Protect node from attacks on kernel memory
– Fork bombs
– PTE eaters
• More precise memory consumption accounting
4

5. Current statusCurrent status
• Merged since 3.12
• Accounting of slub allocations works
– Turn on by setting kmem.limit
• Accounting of buddy allocations partially works
• Limiting implemented, but has issues
• Movitoring via kmem.usage_in_bytes
• Debugging via kmem.slabinfo
5

6. Known issuesKnown issues
• If kmem.limit < mem.limit random syscall failures
happen
– When kmem hits its limit reclaim works poorly
• Not all objects are accounted yet
– PTE-s, pipe and socket buffers, vmalloc
• Shared kernel objects create wierd charge/reclaim
dependencies between cgroups
• TCP network buffers have separate limit
6

7. RecommendationsRecommendations
• Set kmem.limit > mem.limit to turn it on
• Turn on by default
• Configure TCP network buffers limits (per netns
sysctls)
7

8. Thank youThank you