1 ========================= 1 =========================
2 Process Number Controller 2 Process Number Controller
3 ========================= 3 =========================
4 4
5 Abstract 5 Abstract
6 -------- 6 --------
7 7
8 The process number controller is used to allow 8 The process number controller is used to allow a cgroup hierarchy to stop any
9 new tasks from being fork()'d or clone()'d aft 9 new tasks from being fork()'d or clone()'d after a certain limit is reached.
10 10
11 Since it is trivial to hit the task limit with 11 Since it is trivial to hit the task limit without hitting any kmemcg limits in
12 place, PIDs are a fundamental resource. As suc 12 place, PIDs are a fundamental resource. As such, PID exhaustion must be
13 preventable in the scope of a cgroup hierarchy 13 preventable in the scope of a cgroup hierarchy by allowing resource limiting of
14 the number of tasks in a cgroup. 14 the number of tasks in a cgroup.
15 15
16 Usage 16 Usage
17 ----- 17 -----
18 18
19 In order to use the `pids` controller, set the 19 In order to use the `pids` controller, set the maximum number of tasks in
20 pids.max (this is not available in the root cg 20 pids.max (this is not available in the root cgroup for obvious reasons). The
21 number of processes currently in the cgroup is 21 number of processes currently in the cgroup is given by pids.current.
22 22
23 Organisational operations are not blocked by c 23 Organisational operations are not blocked by cgroup policies, so it is possible
24 to have pids.current > pids.max. This can be d 24 to have pids.current > pids.max. This can be done by either setting the limit to
25 be smaller than pids.current, or attaching eno 25 be smaller than pids.current, or attaching enough processes to the cgroup such
26 that pids.current > pids.max. However, it is n 26 that pids.current > pids.max. However, it is not possible to violate a cgroup
27 policy through fork() or clone(). fork() and c 27 policy through fork() or clone(). fork() and clone() will return -EAGAIN if the
28 creation of a new process would cause a cgroup 28 creation of a new process would cause a cgroup policy to be violated.
29 29
30 To set a cgroup to have no limit, set pids.max 30 To set a cgroup to have no limit, set pids.max to "max". This is the default for
31 all new cgroups (N.B. that PID limits are hier 31 all new cgroups (N.B. that PID limits are hierarchical, so the most stringent
32 limit in the hierarchy is followed). 32 limit in the hierarchy is followed).
33 33
34 pids.current tracks all child cgroup hierarchi 34 pids.current tracks all child cgroup hierarchies, so parent/pids.current is a
35 superset of parent/child/pids.current. 35 superset of parent/child/pids.current.
36 36
37 The pids.events file contains event counters: 37 The pids.events file contains event counters:
38 38
39 - max: Number of times fork failed in the cg 39 - max: Number of times fork failed in the cgroup because limit was hit in
40 self or ancestors. 40 self or ancestors.
41 41
42 Example 42 Example
43 ------- 43 -------
44 44
45 First, we mount the pids controller:: 45 First, we mount the pids controller::
46 46
47 # mkdir -p /sys/fs/cgroup/pids 47 # mkdir -p /sys/fs/cgroup/pids
48 # mount -t cgroup -o pids none /sys/fs 48 # mount -t cgroup -o pids none /sys/fs/cgroup/pids
49 49
50 Then we create a hierarchy, set limits and att 50 Then we create a hierarchy, set limits and attach processes to it::
51 51
52 # mkdir -p /sys/fs/cgroup/pids/parent/ 52 # mkdir -p /sys/fs/cgroup/pids/parent/child
53 # echo 2 > /sys/fs/cgroup/pids/parent/ 53 # echo 2 > /sys/fs/cgroup/pids/parent/pids.max
54 # echo $$ > /sys/fs/cgroup/pids/parent 54 # echo $$ > /sys/fs/cgroup/pids/parent/cgroup.procs
55 # cat /sys/fs/cgroup/pids/parent/pids. 55 # cat /sys/fs/cgroup/pids/parent/pids.current
56 2 56 2
57 # 57 #
58 58
59 It should be noted that attempts to overcome t 59 It should be noted that attempts to overcome the set limit (2 in this case) will
60 fail:: 60 fail::
61 61
62 # cat /sys/fs/cgroup/pids/parent/pids. 62 # cat /sys/fs/cgroup/pids/parent/pids.current
63 2 63 2
64 # ( /bin/echo "Here's some processes f 64 # ( /bin/echo "Here's some processes for you." | cat )
65 sh: fork: Resource temporary unavailab 65 sh: fork: Resource temporary unavailable
66 # 66 #
67 67
68 Even if we migrate to a child cgroup (which do 68 Even if we migrate to a child cgroup (which doesn't have a set limit), we will
69 not be able to overcome the most stringent lim 69 not be able to overcome the most stringent limit in the hierarchy (in this case,
70 parent's):: 70 parent's)::
71 71
72 # echo $$ > /sys/fs/cgroup/pids/parent 72 # echo $$ > /sys/fs/cgroup/pids/parent/child/cgroup.procs
73 # cat /sys/fs/cgroup/pids/parent/pids. 73 # cat /sys/fs/cgroup/pids/parent/pids.current
74 2 74 2
75 # cat /sys/fs/cgroup/pids/parent/child 75 # cat /sys/fs/cgroup/pids/parent/child/pids.current
76 2 76 2
77 # cat /sys/fs/cgroup/pids/parent/child 77 # cat /sys/fs/cgroup/pids/parent/child/pids.max
78 max 78 max
79 # ( /bin/echo "Here's some processes f 79 # ( /bin/echo "Here's some processes for you." | cat )
80 sh: fork: Resource temporary unavailab 80 sh: fork: Resource temporary unavailable
81 # 81 #
82 82
83 We can set a limit that is smaller than pids.c 83 We can set a limit that is smaller than pids.current, which will stop any new
84 processes from being forked at all (note that 84 processes from being forked at all (note that the shell itself counts towards
85 pids.current):: 85 pids.current)::
86 86
87 # echo 1 > /sys/fs/cgroup/pids/parent/ 87 # echo 1 > /sys/fs/cgroup/pids/parent/pids.max
88 # /bin/echo "We can't even spawn a sin 88 # /bin/echo "We can't even spawn a single process now."
89 sh: fork: Resource temporary unavailab 89 sh: fork: Resource temporary unavailable
90 # echo 0 > /sys/fs/cgroup/pids/parent/ 90 # echo 0 > /sys/fs/cgroup/pids/parent/pids.max
91 # /bin/echo "We can't even spawn a sin 91 # /bin/echo "We can't even spawn a single process now."
92 sh: fork: Resource temporary unavailab 92 sh: fork: Resource temporary unavailable
93 # 93 #
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.