It seems to be available under Hyper-V isolation mode.
Is this possible in process isolation mode?
In particular, want to limit under Windows node of Kubernetes.
However, physical memory inside the container seems the amount of all memory capacity is allocated, even if set resources: limits: memory:.
For Hyper-V isolation mode the memory limit is 1GB.
For process isolation mode it is unlimited so basically the same memory as the host.
You can find more details documented here.
You can set the limits while using docker-compose, for example:
services:
mssql:
image: microsoft/mssql-server-windows-express
mem_limit: 2048m
would result with 2GB of available memory.
Please let me know if that helped.
Related
We have a container on docker that can use up to 10Gb of memory during specific times of day. When the container is deployed we specified reservation below so that it it placed on the server with most available physical memory. While this part works it does not prevent other containers to be placed on that server as well, and when the containers starts to use up memory it is impacting other containers.
Is there a ways to permanently reserve memory for specific container?
reservations:
cpus: "0.25"
memory: 10000M
I easily managed to do this on the desktop version of Docker via preferences, but how can I do this using console on a remote linux server?
The limits you are configuring in the Docker Desktop UI are on the embedded Linux VM. All containers run within that VM, giving you an upper limit on the sum of all containers. To replicate this on a remote Linux server, you would set the physical hardware or VM constraints to match your limit.
For individual containers, you can specify the following:
--cpus to set the CPU shares allocated to the cgroup. This can be something like 2.5 to allocate up to 2.5 CPU threads to the container. Containers attempting to use more CPU will be throttled.
--memory or -m to set the memory limit in bytes. This is applied to the cgroup the container runs within. Containers attempting to exceed this limit will be killed.
Disk space for containers and images is controlled by the disk space available to /var/lib/docker for the default overlay2 graph driver. You can limit this by placing the directory under a different drive/partition with limited space. For volume mounts, disk space is limited by where the volume mount is sourced, and the default named volumes go back to /var/lib/docker.
Does docker container get the same band-width as the host container? Or do we need to configure min and(or) max. I 've noticed that we need to override default RAM(which is 2 GB) and Swap space configuration if we need to run CPU intensive jobs.
Also do we need to configure the disk-space ? Or does it by default get as much space as the actual hard disk.
Memory and CPU are controlled using cgroups by docker. If you do not configure these, they are unrestricted and can use all of the memory and CPU on the docker host. If you run in a VM, which includes all Docker for Desktop installs, then you will be limited to that VM's resources.
Disk space is usually limited to the disk space available in /var/lib/docker. For that reason, many make this a different mount. If you use devicemapper for docker's graph driver (this has been largely deprecated), created preallocated blocks of disk space, and you can control that block size. You can restrict containers by running them with read-only root filesystems, and mounting volumes into the container that have a limited disk space. I've seen this done with loopback device mounts, but it requires some configuration outside of docker to setup the loopback device. With a VM, you will again be limited by the disk space allocated to that VM.
Network bandwidth is by default unlimited. I have seen an interesting project called docker-tc which monitors containers for their labels and updates bandwidth settings for a container using tc (traffic control).
Does docker container get the same band-width as the host container?
Yes. There is no limit imposed on network utilization. You could maybe impose limits using a bridge network.
Also do we need to configure the disk-space ? Or does it by default get as much space as the actual hard disk.
It depends on which storage driver you're using because each has its own options. For example, devicemapper uses 10G by default but can be configured to use more. The recommended driver now is overlay2. To configure start docker with overlay2.size.
This depends some on what your host system is and how old it is.
In all cases network bandwidth isn't explicitly limited or allocated between the host and containers; a container can do as much network I/O as it wants up to the host's limitations.
On current native Linux there isn't a desktop application and docker info will say something like Storage driver: overlay2 (overlay and aufs are good here too). There are no special limitations on memory, CPU, or disk usage; in all cases a container can use up to the full physical host resources, unless limited with a docker run option.
On older native Linux there isn't a desktop application and docker info says Storage driver: devicemapper. (Consider upgrading your host!) All containers and images are stored in a separate filesystem and the size of that is limited (it is included in the docker info output); named volumes and host bind mounts live outside this space. Again, memory and CPU are not intrinsically limited.
Docker Toolbox and Docker for Mac both use virtual machines to provide a Linux kernel to non-Linux hosts. If you see a "memory" slider you are probably using a solution like this. Disk use for containers, images, and named volumes is limited to the VM capacity, along with memory and CPU. Host bind mounts generally get passed through to the host system.
I'm running Elasticsearch within Kubernetes and despite setting container limits on CPU use, Elasticsearch is able to exceed the limits and starve other containers.
For various reasons, I'm running the containers with:
privileged: true
Would this allow Elasticsearch to ignore the CPU limits?
As you can see in https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities the container in a privileged mode has no reason not to respect the limits it is given. That is, by default. If you run container in a privileged mode and grant it access to enough of the filesystem, you should be able to ie. modify cgroups and escape (set differently) the limits. This would require pretty specific, targeted operation, hence it's doubtfull any software that is not intended to manage cgroups (or exploit the system for more resources) will do that by default.
I develop a application which runs in three containers on my development box with a quadcore with hyperthreading, meaning there are 8 cores to be used by the system and docker.
Thy CPU allocation for the containers is done by docker-compose as follows:
redis: cpu_shares: 1024
mysql: cpu_shares: 1024
app: cpu_shares: 4096
I am troubled by timing out requests to redis. The load is minimal, but the utilization of redis is in bursts with longer breaks, at least in the development environment.
Hence, I assume docker is not assigning enough CPU shares to the redis container. I thought allready to put a constant artificial load on redis to let docker assign more CPU shares to it.
Is there an other way of ensuring a certain CPU share for a container?
With Docker for Mac your containers are all running in a HyperKit VM. The VM has an allocation of CPU and memory which is a subset of the total on your Mac.
You can change the allocation in Preferences - by default the Docker VM has 2 CPUs and 2GB RAM.