Skip to content

Conversation

@thaJeztah
Copy link
Member

There is a not-insignificant performance overhead for all containers (if
containerd is a child of Docker, which is the current setup) if rlimits are
set on the main Docker daemon process (because the limits
propogate to all children).

We recommend using cgroups to do container-local accounting.

This applies the change added in 8db6109
to other init scripts.

relates to #24307

ping @justincormack @tianon @runcom @cyphar PTAL if this looks good to you; I didn't know the best way to verify/test this, but can try if you agree on this

@tianon
Copy link
Member

tianon commented Jul 12, 2016

LGTM!

@cyphar
Copy link
Contributor

cyphar commented Jul 13, 2016

LGTM

@cpuguy83
Copy link
Member

unlimited is still a number, just that it's a really high number.

@thaJeztah
Copy link
Member Author

@cpuguy83 is there a way to set no limit? If setting unlimited does still apply a limit, I wonder if #24307 (and this PR) has any benefits.

@cyphar did you benchmark the difference before/after applying #24307?

@cyphar
Copy link
Contributor

cyphar commented Jul 13, 2016

@thaJeztah According to the reporter of the bug, their benchmark time almost halved (from ~130 minutes to ~80) after setting the ulimits to be unlimited. I saw similar speedups while testing. Note that this only really affects cases where you open and close an unspeakably large number of files for short periods of time. It's possible that it's a systemd-specific issue (I wouldn't be surprised) but it makes sense to me that having a resource limit for the number of open files would cause quite a lot of overhead.

@cyphar
Copy link
Contributor

cyphar commented Jul 13, 2016

@cpuguy83 It looks like for RLIMIT_NOFILE Linux doesn't use RLIM_INFINITY as a special value specifically for the fastpath. So I'm not really sure why there is a performance impact -- it might be some weird quirk of rpm that causes this to happen.

@justincormack
Copy link
Contributor

In fact you don't appear to be able to set RLIMIT_NOFILE to unlimited anyway:

ulimit -n unlimited
bash: ulimit: open files: cannot modify limit: Operation not permitted

It is bounded by /proc/sys/fs/file-max. So that line is not doing anything at all. So it can only be the process limit that is having an effect, if anything there will probably be a lower file limit than before as it was not being raised.

@thaJeztah
Copy link
Member Author

@justincormack hm, that's weird I think it tried that, but maybe I messed up and only tried on ulimit -u 😊 I see the man page mentions;

-n The maximum number of open file descriptors (most systems do not allow this value to be set)

Looks like you can only set a numeric value, that's lower or equal to 1048576, but not a higher one;

ulimit -n 1048576

ulimit -n 1048577
bash: ulimit: open files: cannot modify limit: Operation not permitted

but that limit doesn't match /proc/sys/fs/file-max;

cat /proc/sys/fs/file-max
398153

I'm trying that in a container, so possibly that's related there

@thaJeztah
Copy link
Member Author

So, does setting LimitNOFILE=infinity in systemd work? And why? Or is it silently ignored?

@justincormack
Copy link
Contributor

Try it outside a container, docker may already have that limit set...
On 13 Jul 2016 12:51 p.m., "Sebastiaan van Stijn" [email protected]
wrote:

@justincormack https://github.com/justincormack hm, that's weird I
think it tried that, but maybe I messed up and only tried on ulimit -u 😊
I see the man page mentions
http://man7.org/linux/man-pages/man1/bash.1.html;

-n The maximum number of open file descriptors (most systems do not allow
this value to be set)

Looks like you can only set a numeric value, that's lower or equal to
1048576, but not a higher one;

ulimit -n 1048576

ulimit -n 1048577
bash: ulimit: open files: cannot modify limit: Operation not permitted

but that limit doesn't match /proc/sys/fs/file-max;

cat /proc/sys/fs/file-max
398153

I'm trying that in a container, so possibly that's related there


You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#24555 (comment), or mute
the thread
https://github.com/notifications/unsubscribe/AAdcPMGGjZNiOldl4tMntHJAMjmyyWjyks5qVNE-gaJpZM4JK1Uw
.

@thaJeztah
Copy link
Member Author

nope, looks to be the same;

root@dockr:~# ulimit -n 1048576
root@dockr:~# ulimit -n 1048577
-bash: ulimit: open files: cannot modify limit: Operation not permitted
root@dockr:~# ulimit -n unlimited
-bash: ulimit: open files: cannot modify limit: Operation not permitted
cat /proc/sys/fs/file-max
100809

There is a not-insignificant performance overhead for all containers (if
containerd is a child of Docker, which is the current setup) if rlimits are
set on the main Docker daemon process (because the limits
propogate to all children).

We recommend using cgroups to do container-local accounting.

This applies the change added in 8db6109
to other init scripts.

Note that nfile cannot be set to unlimited, and the limit
is hardcoded to 1048576 (2^20) , see:
http://stackoverflow.com/a/1213069/1811501

Signed-off-by: Sebastiaan van Stijn <[email protected]>
@thaJeztah thaJeztah force-pushed the to-infinity-and-beyond branch from 7f5543e to 428d733 Compare July 13, 2016 15:17
@thaJeztah thaJeztah changed the title Don't set ulimits (nproc, nfile) for all init scripts Don't set ulimits (nproc) for all init scripts Jul 13, 2016
@thaJeztah
Copy link
Member Author

Updated to only set nproc, and updated the systemd unit file accordingly; @cyphar can you confirm if setting LimitNOFILE=infinity actually worked? The systemd documentation seems to indicate it accepts the same values as ulimit -n; https://www.freedesktop.org/software/systemd/man/systemd.exec.html#id-1.7.2.29.17.3

@justincormack
Copy link
Contributor

LGTM

@LK4D4
Copy link
Contributor

LK4D4 commented Jul 28, 2016

LGTM

@LK4D4 LK4D4 merged commit 4084bf7 into moby:master Jul 28, 2016
@cyphar
Copy link
Contributor

cyphar commented Jul 28, 2016

@thaJeztah LimitNOFILE=infinity definitely works. I'm currently running a Docker daemon with that limit set.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants