文章标题

参考资源限制方法两种

资源限制针对 docker daemon  ( 不针对 contrainer )
资源限制针对 docker contrainer  (针对 contrainer 及 contrainer 下所有的进程 )

针对进程, 用户资源限制

针对系统内核进行优化:

/etc/sysctl.conf
fs.file-max=3836960

针对用户资源限制

 /etc/security/limits.d/25-nofile.conf
root            soft  nofile  196605
root            hard  nofile  196605
* soft  nofile  196605
* hard  nofile  196605

效果如下

[root@docker-ovs01 ~]# ulimit -n
196605

[root@docker-ovs01 ~]# ps
PID TTY          TIME CMD
2864 pts/0    00:00:00 bash

[root@docker-ovs01 ~]# cat /proc/2864/limits
Limit                 Soft Limit           Hard Limit           Units
Max open files            196605               196605           files

docker 进程资源限制

/usr/lib/systemd/system/docker.service
[Service]
LimitMEMLOCK=1288490188800
LimitSTACK=infinity
LimitNPROC=infinity
LimitNOFILE=196605
LimitCORE=infinity

效果如下 (参考 nofile, memlock 设定 )

[root@docker-ovs01 ~]# ps aux | grep /usr/bin/docker
root      3133  0.1  0.7 510716 28068 ?        Ssl  16:03   0:00 /usr/bin/docker daemon -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock --cluster-store=etcd://192.168.209.40:2379,192.168.209.41:2379,192.168.209.42:2379 --default-ulimit nofile=1310720 --default-ulimit memlock=128849018880 --default-ulimit core=-1 --default-ulimit nproc=-1 --default-ulimit stack=-1 --storage-driver devicemapper --storage-opt dm.fs=xfs --storage-opt dm.thinpooldev=/dev/mapper/docker--vg-docker--pool --storage-opt dm.use_deferred_removal=true --storage-opt dm.use_deferred_deletion=true --storage-opt dm.basesize=50G --add-registry registry.vclound.com:5000 --insecure-registry registry.vclound.com:5000

[root@docker-ovs01 ~]# cat /proc/3133/limits
Limit                     Soft Limit           Hard Limit          Units
Max open files                196605               196605          files
Max locked memory      1288490188800        1288490188800          bytes

针对 docker contrainer 资源限制设定

/usr/bin/docker daemon  ....... --default-ulimit nofile=131072 --default-ulimit memlock=128849018880 --default-ulimit core=-1 --default-ulimit nproc=-1 --default-ulimit stack=-1 ..... 

启动 docker contrainer, docker 下生成的进程,

docker run -d -ti  registry.vclound.com:5000/hyphenwang/sshdserver:v1

效果

[root@docker-ovs01 ~]# ps aux | grep sup
root      3722  0.2  0.3 102328 12248 pts/3    Ss+  16:53   0:00 /usr/bin/python /usr/bin/supervisord -c /etc/supervisord.conf

[root@docker-ovs01 ~]# cat /proc/3722/limits
Limit                       Soft Limit           Hard Limit           Units
Max open files                  131072               131072           files
Max locked memory         128849018880         128849018880           bytes

总结

对象	配置对象	作用	针对性
物理机	/etc/sysct.conf + /etc/security/limits.conf	针对物理机上进程资源 (limits)	( = 物理机上所有 PID )
docker.service	限制 /usr/bin/docker daemon 进程启动时候	/proc/PID/limits 资源	docker 主进程
/usr/bin/docker daemon ……. –default-ulimit nofile=131072 –default-ulimit memlock=128849018880 –default-ulimit core=-1 –default-ulimit nproc=-1 –default-ulimit stack=-1	命令启动时配置	限制了 contrainer 中的进程	docker 子进程