#cgroups — Public Fediverse posts

After having been almost exclusively on the platform level of #Kubernetes for half a decade, it's definitely a change of scenery to be helping #Java developers moving legacy stuff from VMs to containers.

Today I went down the rabbit hole to investigate Java 8 container resource awareness. As expected, the support was spotty and outdated, requiring the old #cgroups v1. With a bit of hacking, if should be possible to add the proper parameters at runtime though, preventing the memory hungry Java container from the dreaded #OutOfMemory or OOM kill.

I miss having more control over the #platform, but that's not in the cards this time around.

After having been almost exclusively on the platform level of #Kubernetes for half a decade, it's definitely a change of scenery to be helping #Java developers moving legacy stuff from VMs to containers.

Today I went down the rabbit hole to investigate Java 8 container resource awareness. As expected, the support was spotty and outdated, requiring the old #cgroups v1. With a bit of hacking, if should be possible to add the proper parameters at runtime though, preventing the memory hungry Java container from the dreaded #OutOfMemory or OOM kill.

I miss having more control over the #platform, but that's not in the cards this time around.

Making a firewall using eBPFs and cgroups

You can see entire implementation at https://github.com/nikofil/ebpf-firewall/

https://nfil.dev/coding/security/ebpf-firewall-with-cgroups/

#Linux #firewall #ebpf #cgroups

👀 So, here's 18 minutes of pure geeky bliss where we pretend #sandboxing is as thrilling as bungee jumping. 🏗️ Let's endlessly list things like namespaces, #cgroups, and #gVisor while forgetting that 99% of readers are now asleep. 😴 Keep your kernels close, folks, because apparently, they’re the rockstars of this yawn-fest. 🎸
https://www.shayon.dev/post/2026/52/lets-discuss-sandbox-isolation/ #geekybliss #techhumor #HackerNews #ngated

👀 So, here's 18 minutes of pure geeky bliss where we pretend #sandboxing is as thrilling as bungee jumping. 🏗️ Let's endlessly list things like namespaces, #cgroups, and #gVisor while forgetting that 99% of readers are now asleep. 😴 Keep your kernels close, folks, because apparently, they’re the rockstars of this yawn-fest. 🎸
https://www.shayon.dev/post/2026/52/lets-discuss-sandbox-isolation/ #geekybliss #techhumor #HackerNews #ngated

🔍 Why do Kubernetes pods show the FULL host's CPU/RAM even with strict limits set?

Learn how cgroups, metrics servers, and monitoring tools actually work — and how to get accurate pod resource visibility.

#Kubernetes #DevOps #CloudNative #Observability #cgroups
🔗 https://devopstales.github.io/kubernetes/k8s-limits/

A #nixos #flake #part that lets a #grafana #dashboard be auto-added to any flake. Shows #psi #pressure #cgroups & #systemd processes.

https://codeberg.org/adingbatponder/reticulum_nixos_flake/src/branch/main/features/monitoring

(Handles existing #grafana installs: adds another #dashboard. Import tested on a few machines. Feedback or issue reports welcome.)

@arianvp @mdione @EduNET_LK @bustikiller

A #nixos #flake #part that lets a #grafana #dashboard be auto-added to any flake. Shows #psi #pressure #cgroups & #systemd processes.

https://codeberg.org/adingbatponder/reticulum_nixos_flake/src/branch/main/features/monitoring

(Handles existing #grafana installs: adds another #dashboard. Import tested on a few machines. Feedback or issue reports welcome.)

@arianvp @mdione @EduNET_LK @bustikiller

Изоляция и лимитирование пользователей хостинга с ОС «МСВСфера Сервер» 9 редакция для хостинг-провайдеров

Хостинг - это десятки тысяч сайтов и пользователей находящихся под управлением одного сервера. Зачастую пользователь хостинга не погружается в детали настроек сервера, а знает только основное — на сервере есть PHP, Ruby, Python, MySQL и Apache, чтобы его сайт успешно функционировал . Ему не интересно, как и что настроено на сервере, главное, чтоб все работало и не создавало ему проблем.

https://habr.com/ru/companies/inferit/articles/954302/

#хостинг #лимиты #изоляция #многопользовательская_работа #cgroups #безопасность_вебприложений

#TIL #cgroups' memory.current metric includes any #pagecache entries that a process in the #cgroup caused to be inserted, even if other processes are accessing it too.

This means that anything related to #systemd unit's memory accounting also inherits this property.

If your #emacs systemd unit reports insane memory usage (usually ~10G for me), this is why.
It's actually not emacs' fault for once ;)

#linux #kernel #MemoryAccounting

Systemd: полное руководство для админов + примеры

Привет, Хабр! Systemd - скелет современного Linux. Он управляет не только службами, но и таймерами, монтированием, логированием... Понимать его = значительно повысить эффективность администрирования системы. Данное руководство - исключительно технические аспекты: архитектура, юниты, cgroups, работа с журналами. Только команды и конфиги.

https://habr.com/ru/articles/942760/

#Linux #systemd #демон #юниты #systemctl #journalctl #cgroups #системное_администрирование

Docker изнутри: исчерпывающее руководство. Механизмы контейнеризации + примеры, эксперименты и реализация

Docker — не магия, а грамотное применение механизмов Linux. Разбираем инструмент, который пугает своей сложностью не меньше блокчейна. Показываем на пальцах как работают: Namespaces, Cgroups, OverlayFS – основные компоненты любого контейнера, и как стандарт OCI объединяет их в единую экосистему. Об этом и не только в статье.

https://habr.com/ru/articles/935178/

#docker #контейнеризация #namespaces #cgroups #linux_kernel #виртуализация #runc #golang #linux

So, if I run my entire backup script with `systemd-run --user --slice=lowcpu --nice=19` it constrains the CPU as I've configured it in the `lowcpu.slice` I created. 👍

If I add `systemd-run --user --slice=lowcpu --nice=19` to individual `restic` invocations inside the script, it doesn't. WTF. 👎

#systemd #cgroups

So, if I run my entire backup script with `systemd-run --user --slice=lowcpu --nice=19` it constrains the CPU as I've configured it in the `lowcpu.slice` I created. 👍

If I add `systemd-run --user --slice=lowcpu --nice=19` to individual `restic` invocations inside the script, it doesn't. WTF. 👎

#systemd #cgroups

systemd: takes over cgroups

also systemd: doesn't work to control cpu.max

Back to reading manpages, I guess.

#systemd #cgroups

systemd: takes over cgroups

also systemd: doesn't work to control cpu.max

Back to reading manpages, I guess.

#systemd #cgroups

🎉 Oh, rejoice! Another riveting deep dive into the thrilling world of #CPU #slicing with #cgroups 🤖, because obviously, your life was missing the soaring excitement of "Building Burstables". Meanwhile, #NewEuroGPT Enterprise promises to keep your data private, as if your browsing history is more interesting than the latest cat meme 🐱.
https://www.ubicloud.com/blog/building-burstables-cpu-slicing-with-cgroups #DataPrivacy #TechTrends #Burstables #HackerNews #ngated

🎉 Oh, rejoice! Another riveting deep dive into the thrilling world of #CPU #slicing with #cgroups 🤖, because obviously, your life was missing the soaring excitement of "Building Burstables". Meanwhile, #NewEuroGPT Enterprise promises to keep your data private, as if your browsing history is more interesting than the latest cat meme 🐱.
https://www.ubicloud.com/blog/building-burstables-cpu-slicing-with-cgroups #DataPrivacy #TechTrends #Burstables #HackerNews #ngated

Building Burstables: CPU slicing with cgroups

https://www.ubicloud.com/blog/building-burstables-cpu-slicing-with-cgroups

#HackerNews #BuildingBurstables #CPU #Slicing #cgroups #CloudComputing #TechInnovation

Building Burstables: CPU slicing with cgroups

https://www.ubicloud.com/blog/building-burstables-cpu-slicing-with-cgroups

#HackerNews #BuildingBurstables #CPU #Slicing #cgroups #CloudComputing #TechInnovation

What if I told you, #Linux doesn’t just support multiple users — it supports multiple isolated worlds via #namespaces, #cgroups, and #containers.

What if I told you, #Linux doesn’t just support multiple users — it supports multiple isolated worlds via #namespaces, #cgroups, and #containers.

@ShadowJonathan if it's only about simulating those conditions for a single process (and its sub-processes), cgroups might be worth a look.

If you don't want to fiddle around with the low-level details of them, wrap the execution of your process in "systemd-run --user --wait --pty ..." and use "--slice" to assign the process to the corresponding slice with the desired resource constraints.

https://www.freedesktop.org/software/systemd/man/latest/systemd-run.html

https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html

#systemd #cgroups

@ShadowJonathan if it's only about simulating those conditions for a single process (and its sub-processes), cgroups might be worth a look.

If you don't want to fiddle around with the low-level details of them, wrap the execution of your process in "systemd-run --user --wait --pty ..." and use "--slice" to assign the process to the corresponding slice with the desired resource constraints.

https://www.freedesktop.org/software/systemd/man/latest/systemd-run.html

https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html

#systemd #cgroups

[Перевод] Как собрать Linux-контейнер с нуля и без Docker

Перевели для вас статью про то, как с нуля создать Linux-контейнер, аналогичный тому, который можно запустить с помощью Docker, но без использования Docker или других инструментов контейнеризации.

https://habr.com/ru/companies/flant/articles/880354/

#контейнеризация #контейнеры #containers #cgroups #namespaces #linux #linuxконтейнеры #docker #root #overlayfs

Устраняем эффект шумного соседа в PostgreSQL с помощью cgroups

Если вы когда-нибудь запускали несколько экземпляров PostgreSQL или другого ПО на одной машине (виртуальной или физической), то наверняка сталкивались с эффектом шумного соседа, когда инстансы мешали друг другу работать. Так как же примерить «соседей»? У нас есть эффективный способ.

https://habr.com/ru/companies/postgrespro/articles/878844/

#cgroups_v2 #cgroups #postgresql #linux #администрирование_linuxсистем #нагрузка

Мой первый контейнер без Docker

Технологии контейнеризации, возможно, как и у большинства из нас, плотно засели в моей голове. И казалось бы, просто пиши Dockerfile и не выпендривайся. Но всегда же хочется узнавать что‑то новое и углубляться в уже освоенные темы. По этой причине я решил разобраться в реализации контейнеров в ОС на базе ядра linux и в последствие создать свой «контейнер» через cmd.

https://habr.com/ru/articles/881428/

#docker #контейнер #контейнеризация #linux #namespace #cgroups #cgroup_v2

Today, the typical downwards spiral, from "just start up the devel VM":

$ vagrant up

Followed by: Why doesn't it start? 😕

Why libvirtd service won't restart? 😳

Finally ending, after a long search, at: Why /sys/fs/cgroups/ is empty??? 😱

Should I try to repopulate it, or just reboot? 🤔

Oh already that late? Reboot then.

#cgroups, #libvirt

Today, the typical downwards spiral, from "just start up the devel VM":

$ vagrant up

Followed by: Why doesn't it start? 😕

Why libvirtd service won't restart? 😳

Finally ending, after a long search, at: Why /sys/fs/cgroups/ is empty??? 😱

Should I try to repopulate it, or just reboot? 🤔

Oh already that late? Reboot then.

#cgroups, #libvirt

I'm using #ansible to automate #helm which automates #kubectl which automates #crio which automates #cgroups and #namespaces. #kubernetes is #turtlesallthewaydown

I'm using #ansible to automate #helm which automates #kubectl which automates #crio which automates #cgroups and #namespaces. #kubernetes is #turtlesallthewaydown

@boudah @robpumphrey

That says that it moved to https://github.com/opsengine/cpulimit 12 years ago.

That said, if portability is not a concern, adjusting the max bandwidth of the cpu controllers of a dedicated control group for Chrome processes is the better approach.

#cpulimit #linux #cgroups

@boudah @robpumphrey

That says that it moved to https://github.com/opsengine/cpulimit 12 years ago.

That said, if portability is not a concern, adjusting the max bandwidth of the cpu controllers of a dedicated control group for Chrome processes is the better approach.

#cpulimit #linux #cgroups

Влияние MD checking на производительность и методы уменьшения влияния на работоспособность системы

MD (Multiple Device) — это технология в Linux, которая позволяет объединять несколько физических дисков в один логический накопитель с помощью различных схем RAID (Redundant Array of Independent Disks). mdXXX (далее md disk) — это одино из устройств, созданных с использованием этой технологии. Для определения влияния проверки состояния (checking) массива md disk на производительность системы необходимо рассмотреть несколько аспектов.

https://habr.com/ru/articles/831718/

#mdraid #ionice #cgroups #checking

I'm just going to say it, and we can agree to disagree if you do in fact disagree...

systemd has categorically made Linux better in basically every way imaginable

It's earnestly cool if you don't agree but it's really really good

🤷

#systemd #linux #cgroups #init

I'm just going to say it, and we can agree to disagree if you do in fact disagree...

systemd has categorically made Linux better in basically every way imaginable

It's earnestly cool if you don't agree but it's really really good

🤷

#systemd #linux #cgroups #init

New cool example for ebpf_exporter: CFS delay histogram. In addition to knowing overall CFS throttlig delay from cgroups in cpu.state, now you can have a histogram of individual throttling durations in prometheus.

* https://github.com/cloudflare/ebpf_exporter/pull/311

As a bonus, you get a bpftrace command to observe these.

#ebpf #ebpf_exporter #cgroups #cfs #bpftrace #prometheus

New cool example for ebpf_exporter: CFS delay histogram. In addition to knowing overall CFS throttlig delay from cgroups in cpu.state, now you can have a histogram of individual throttling durations in prometheus.

* https://github.com/cloudflare/ebpf_exporter/pull/311

As a bonus, you get a bpftrace command to observe these.

#ebpf #ebpf_exporter #cgroups #cfs #bpftrace #prometheus

The main problem I was facing wasn't actually related to #riscv although I experimented several times to get the right U-Boot, U-Boot environment, kernel and dtb combo. It ook my a while to figure out how to get #libvirt #LXC working. Was suspecting something missing in kernel config, but in the end it was #cgroups. Had to disable unified hiearchy to get libvirt-lxc working. Weird, but it did the trick. And I also spend quite some time debuging why my minoins can't connect to my #SaltStack master just to realize after few weeks that I changed the #IPv6 subnet on LAN and as my #DNS records are updated via Salt and as the minions can't connect, they were still pointing to the old IP. It was easilly fixed after I got my minions connected again. A little downside of IPv6 is that you easilly miss that one of those many numbers changed.

Do you ever wish that you could monitor cgroup creation / removal race-free with fanotify? Now you can! Any kernfs works!

Linux v6.6-rc1 is out and it contains my commit:

* https://github.com/torvalds/linux/commit/0ce7c12e88cf

Example usage in Go:

* https://github.com/cloudflare/ebpf_exporter/pull/244

All you do is ask for events from a mount and then read them in a loop. No need to re-arm watches like with inotify.

The patch is trivial and can be easily backported if you want it in an older kernel.

#linux #kernel #ebpf #fanotify #cgroups

"Adhemerval Zanella (5):
linux: Add posix_spawnattr_{get,set}cgroup_np (BZ 26731)
posix: Add pidfd_spawn and pidfd_spawnp (BZ 30349)
posix: Add pidfd_fork (BZ 26371)
posix: Add PIDFDFORK_NOSIGCHLD for pidfd_fork
linux: Add pidfd_getpid"

YES YES YES, TO ALL OF IT.
https://sourceware.org/pipermail/libc-alpha/2023-July/149741.html

#glibc #linux #kernel #pidfd #cgroups

Rootless Podman

Mit etwas Vorbereitung ist es möglich Podman Container als regulärer Benutzer auszuführen.

#Podman #Rootless #cgroups #Container #Linux

https://gnulinux.ch/rootless-podman

Watch out #WhatsApp et all.

#RFE
@google

@Android

@Apple

#cgroups for #Contacts apps via #GroupsOfContacts

Does anyone know how to associate a #container from a #cgroups in #kubernetes? Can I find out the cgroups of a container through Kube API or kubelet? Or should I need to hook into container runtime? I would appreciate any pointers.