linux内核与docker内核优化

linux内核优化

http://blog.51cto.com/yangrong/1321594

1、操作系统关闭THP
vim /etc/rc.d/rc.local
增加下列内容：
if test -f /sys/kernel/mm/transparent_hugepage/enabled; then
echo never > /sys/kernel/mm/transparent_hugepage/enabled
fi
if test -f /sys/kernel/mm/transparent_hugepage/defrag; then
echo never > /sys/kernel/mm/transparent_hugepage/defrag
fi
然后给rc.local添加可执行权限：chmod +x /etc/rc.d/rc.local。重启生效
2、切换到root用户修改配置sysctl.conf

vim /etc/sysctl.conf

添加配置：

vm.max_map_count=655360

vm.overcommit_memory=1

net.core.somaxconn= 1024

3、vim /etc/security/limits.conf

添加

• soft nofile 65536

• hard nofile 65536

• soft nproc 65536

• hard nproc 65536

vi /etc/security/limits.d/20-nproc.conf

加大普通用户限制 也可以改为unlimited

• soft nproc 40960

root soft nproc unlimited

reboot或者重新登录

4、内存设置
vm.min_free_kbytes：系统保留给内核用的内存。
vm.extra_free_kbytes：系统保留给应用的free内存

docker内核优化

对于docker container的调优还是和普通的Linux调优有很大的区别。

直接修改 container的 /etc/security/limits.conf无效

在host上执行

sudo sh -c 'printf "\nulimit -HSn 999999\n" >> /etc/sysconfig/docker'

sudo service docker restart

2、sysctl.conf TCPIP相关的
如果容器用host网络模式，与host共用同一个网络堆栈，只要修改host的网络配置即可

如果不是，那咋办?
容器会有自己的独立网络堆栈，修改host的配置无效.

docker run --sysctl net.ipv4.ip_forward=1 someimage

sysctls
Kernel parameters to set in the container. You can use either an array or a dictionary.

sysctls:
net.core.somaxconn: 1024
net.ipv4.tcp_syncookies: 0

sysctls:

• net.core.somaxconn=1024
• net.ipv4.tcp_syncookies=0

3、如何禁用THP

Do it on the host before starting the container
Start the container in privileged mode and then you should be able to modify it

docker run --privileged 11.4.76.193/redis/redis:pro

docker run -ti --privileged ubuntu /bin/bash
echo never | tee /sys/kernel/mm/transparent_hugepage/enabled
echo never | tee /sys/kernel/mm/transparent_hugepage/defrag
I ended up creating an image for this and made redis/mariadb include it under depends_on in my docker-compose.yml file

FROM ubuntu:latest
COPY ./docker-entrypoint.sh /
ENTRYPOINT ["/docker-entrypoint.sh"]
where docker-entrypoint.sh has:

!/bin/bash

set -e

echo never | tee /sys/kernel/mm/transparent_hugepage/enabled
echo never | tee /sys/kernel/mm/transparent_hugepage/defrag