-
What cgroups are: how linux limits cpu and memory
cgroup is the kernel structure that says how much CPU and memory a process (or a container) can use. Measured in a container with -m 256m and --cpus 0.5: memory.max = 268435456 bytes and cpu.max = quota 50000 us per 100000 us.
-
How to limit memory, logs and restarts of a container
Four limits cover most container problems in production: a memory cap, a pids cap, log rotation and a restart policy with a retry count. The compose.yaml below is the whole file, commented.
-
How to actually run a container as non-root
user, cap_drop ALL, read_only and no-new-privileges. Measured: with no lock the process keeps 14 capabilities and writes to /etc; with user 1000 the capabilities drop to zero and the /dados volume needs an owner.
You reached the end. Every post is here.