-
Notifications
You must be signed in to change notification settings - Fork 18.9k
Don't set ulimits (nproc) for all init scripts #24555
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
LGTM! |
|
LGTM |
|
unlimited is still a number, just that it's a really high number. |
|
@thaJeztah According to the reporter of the bug, their benchmark time almost halved (from ~130 minutes to ~80) after setting the ulimits to be unlimited. I saw similar speedups while testing. Note that this only really affects cases where you open and close an unspeakably large number of files for short periods of time. It's possible that it's a systemd-specific issue (I wouldn't be surprised) but it makes sense to me that having a resource limit for the number of open files would cause quite a lot of overhead. |
|
@cpuguy83 It looks like for |
|
In fact you don't appear to be able to set It is bounded by |
|
@justincormack hm, that's weird I think it tried that, but maybe I messed up and only tried on
Looks like you can only set a numeric value, that's lower or equal to 1048576, but not a higher one; but that limit doesn't match I'm trying that in a container, so possibly that's related there |
|
So, does setting |
|
Try it outside a container, docker may already have that limit set...
|
|
nope, looks to be the same; |
There is a not-insignificant performance overhead for all containers (if containerd is a child of Docker, which is the current setup) if rlimits are set on the main Docker daemon process (because the limits propogate to all children). We recommend using cgroups to do container-local accounting. This applies the change added in 8db6109 to other init scripts. Note that nfile cannot be set to unlimited, and the limit is hardcoded to 1048576 (2^20) , see: http://stackoverflow.com/a/1213069/1811501 Signed-off-by: Sebastiaan van Stijn <[email protected]>
7f5543e to
428d733
Compare
|
Updated to only set |
|
LGTM |
|
LGTM |
|
@thaJeztah |
There is a not-insignificant performance overhead for all containers (if
containerd is a child of Docker, which is the current setup) if rlimits are
set on the main Docker daemon process (because the limits
propogate to all children).
We recommend using cgroups to do container-local accounting.
This applies the change added in 8db6109
to other init scripts.
relates to #24307
ping @justincormack @tianon @runcom @cyphar PTAL if this looks good to you; I didn't know the best way to verify/test this, but can try if you agree on this