94 lines · plain
1=========================2Process Number Controller3=========================4 5Abstract6--------7 8The process number controller is used to allow a cgroup hierarchy to stop any9new tasks from being fork()'d or clone()'d after a certain limit is reached.10 11Since it is trivial to hit the task limit without hitting any kmemcg limits in12place, PIDs are a fundamental resource. As such, PID exhaustion must be13preventable in the scope of a cgroup hierarchy by allowing resource limiting of14the number of tasks in a cgroup.15 16Usage17-----18 19In order to use the `pids` controller, set the maximum number of tasks in20pids.max (this is not available in the root cgroup for obvious reasons). The21number of processes currently in the cgroup is given by pids.current.22 23Organisational operations are not blocked by cgroup policies, so it is possible24to have pids.current > pids.max. This can be done by either setting the limit to25be smaller than pids.current, or attaching enough processes to the cgroup such26that pids.current > pids.max. However, it is not possible to violate a cgroup27policy through fork() or clone(). fork() and clone() will return -EAGAIN if the28creation of a new process would cause a cgroup policy to be violated.29 30To set a cgroup to have no limit, set pids.max to "max". This is the default for31all new cgroups (N.B. that PID limits are hierarchical, so the most stringent32limit in the hierarchy is followed).33 34pids.current tracks all child cgroup hierarchies, so parent/pids.current is a35superset of parent/child/pids.current.36 37The pids.events file contains event counters:38 39 - max: Number of times fork failed in the cgroup because limit was hit in40 self or ancestors.41 42Example43-------44 45First, we mount the pids controller::46 47 # mkdir -p /sys/fs/cgroup/pids48 # mount -t cgroup -o pids none /sys/fs/cgroup/pids49 50Then we create a hierarchy, set limits and attach processes to it::51 52 # mkdir -p /sys/fs/cgroup/pids/parent/child53 # echo 2 > /sys/fs/cgroup/pids/parent/pids.max54 # echo $$ > /sys/fs/cgroup/pids/parent/cgroup.procs55 # cat /sys/fs/cgroup/pids/parent/pids.current56 257 #58 59It should be noted that attempts to overcome the set limit (2 in this case) will60fail::61 62 # cat /sys/fs/cgroup/pids/parent/pids.current63 264 # ( /bin/echo "Here's some processes for you." | cat )65 sh: fork: Resource temporary unavailable66 #67 68Even if we migrate to a child cgroup (which doesn't have a set limit), we will69not be able to overcome the most stringent limit in the hierarchy (in this case,70parent's)::71 72 # echo $$ > /sys/fs/cgroup/pids/parent/child/cgroup.procs73 # cat /sys/fs/cgroup/pids/parent/pids.current74 275 # cat /sys/fs/cgroup/pids/parent/child/pids.current76 277 # cat /sys/fs/cgroup/pids/parent/child/pids.max78 max79 # ( /bin/echo "Here's some processes for you." | cat )80 sh: fork: Resource temporary unavailable81 #82 83We can set a limit that is smaller than pids.current, which will stop any new84processes from being forked at all (note that the shell itself counts towards85pids.current)::86 87 # echo 1 > /sys/fs/cgroup/pids/parent/pids.max88 # /bin/echo "We can't even spawn a single process now."89 sh: fork: Resource temporary unavailable90 # echo 0 > /sys/fs/cgroup/pids/parent/pids.max91 # /bin/echo "We can't even spawn a single process now."92 sh: fork: Resource temporary unavailable93 #94