Skip to content

Deprecate KernelMemory#41254

Merged
tiborvass merged 1 commit intomoby:masterfrom
AkihiroSuda:deprecate-kernel-memory
Jul 28, 2020
Merged

Deprecate KernelMemory#41254
tiborvass merged 1 commit intomoby:masterfrom
AkihiroSuda:deprecate-kernel-memory

Conversation

@AkihiroSuda
Copy link
Member

@AkihiroSuda AkihiroSuda commented Jul 24, 2020

- What I did
Deprecate Kernel Memory.

Kernel memory limit is not supported on cgroup v2. Even on cgroup v1, kernel memory limit (kmem.limit_in_bytes) has been deprecated since kernel 5.4.
torvalds/linux@0158115

Fix #41252

- How to verify it

$ docker run -it --rm --kernel-memory 32m alpine
WARNING: Specifying a kernel memory limit is deprecated and will be removed in a future release.
/ #

- Description for the changelog

Deprecate KernelMemory (docker run --kernel-memory)

- A picture of a cute animal (not mandatory but encouraged)
🐧

Copy link
Member

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

Copy link
Member

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@thaJeztah
Copy link
Member

@thaJeztah thaJeztah added this to the 20.03.0 milestone Jul 24, 2020
Kernel memory limit is not supported on cgroup v2.
Even on cgroup v1, kernel memory limit (`kmem.limit_in_bytes`) has been deprecated since kernel 5.4.
torvalds/linux@0158115

Signed-off-by: Akihiro Suda <[email protected]>
@AkihiroSuda
Copy link
Member Author

updated

@AkihiroSuda AkihiroSuda force-pushed the deprecate-kernel-memory branch from 1f7e3db to b8ca7de Compare July 24, 2020 11:45
AkihiroSuda added a commit to AkihiroSuda/docker-cli that referenced this pull request Jul 24, 2020
`docker run --kernel-memory` is being deprecated in moby/moby#41254

Signed-off-by: Akihiro Suda <[email protected]>
@AkihiroSuda
Copy link
Member Author

CLI docs: docker/cli#2652

AkihiroSuda added a commit to AkihiroSuda/docker-cli that referenced this pull request Jul 24, 2020
`docker run --kernel-memory` is being deprecated in moby/moby#41254

Signed-off-by: Akihiro Suda <[email protected]>
Copy link
Member

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

docker-jenkins pushed a commit to docker-archive/docker-ce that referenced this pull request Jul 27, 2020
`docker run --kernel-memory` is being deprecated in moby/moby#41254

Signed-off-by: Akihiro Suda <[email protected]>
Upstream-commit: 074a8dcff6a1cb2699645ccfca92e7dea09fee8e
Component: cli
@AkihiroSuda
Copy link
Member Author

@cpuguy83 PTAL

@tiborvass tiborvass merged commit 846b7e2 into moby:master Jul 28, 2020
eiffel-fl pushed a commit to eiffel-fl/cli that referenced this pull request Jul 28, 2020
`docker run --kernel-memory` is being deprecated in moby/moby#41254

Signed-off-by: Akihiro Suda <[email protected]>
thaJeztah added a commit to thaJeztah/cli that referenced this pull request Jul 28, 2020
full diff: http://github.com/docker/docker/compare/78e6ffd279b627ebba046b9675ff4849091d9cc3...0f41a77c6993ade605a639fb25994cfe5e1b3fe8

Relevant changes:

- moby/moby#41234 vendor: update buildkit to 4d1f260e8
- various updates to swagger files
- moby/moby#41249 Replace swarm Capabilites API with cap add/drop API
    - updates swarmkit to 035d564a3686f5e348d861ec0c074ff26854c498
- moby/moby#41254 Deprecate KernelMemory

Signed-off-by: Sebastiaan van Stijn <[email protected]>
docker-jenkins pushed a commit to docker-archive/docker-ce that referenced this pull request Jul 29, 2020
full diff: http://github.com/docker/docker/compare/78e6ffd279b627ebba046b9675ff4849091d9cc3...0f41a77c6993ade605a639fb25994cfe5e1b3fe8

Relevant changes:

- moby/moby#41234 vendor: update buildkit to 4d1f260e8
- various updates to swagger files
- moby/moby#41249 Replace swarm Capabilites API with cap add/drop API
    - updates swarmkit to 035d564a3686f5e348d861ec0c074ff26854c498
- moby/moby#41254 Deprecate KernelMemory

Signed-off-by: Sebastiaan van Stijn <[email protected]>
Upstream-commit: 097d57314d12c5b2b8dd267353172e51948a25f1
Component: cli
akerouanton pushed a commit to akerouanton/cli that referenced this pull request Jul 29, 2020
`docker run --kernel-memory` is being deprecated in moby/moby#41254

Signed-off-by: Akihiro Suda <[email protected]>
akerouanton pushed a commit to akerouanton/cli that referenced this pull request Jul 29, 2020
full diff: http://github.com/docker/docker/compare/78e6ffd279b627ebba046b9675ff4849091d9cc3...0f41a77c6993ade605a639fb25994cfe5e1b3fe8

Relevant changes:

- moby/moby#41234 vendor: update buildkit to 4d1f260e8
- various updates to swagger files
- moby/moby#41249 Replace swarm Capabilites API with cap add/drop API
    - updates swarmkit to 035d564a3686f5e348d861ec0c074ff26854c498
- moby/moby#41254 Deprecate KernelMemory

Signed-off-by: Sebastiaan van Stijn <[email protected]>
@jimaek
Copy link

jimaek commented Dec 14, 2020

With this option gone, what is the correct method of protecting the host machine from fork-bombs running inside containers?

@thaJeztah
Copy link
Member

@jimaek --pids-limit should still allow you to limit number of processes started within the container.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Deprecate docker run --kernel-memory

4 participants