系统进程资源限制以及Docker容器资源限制

最新推荐文章于 2025-04-21 08:30:00 发布

zcx1203

最新推荐文章于 2025-04-21 08:30:00 发布

阅读量376

点赞数

本文链接：https://blog.youkuaiyun.com/zcx1203/article/details/90750988

版权

linux 专栏收录该内容

37 篇文章

订阅专栏

本文探讨了如何查看和设置Docker容器的内存和CPU限制，以确保资源的有效管理和隔离。同时，也讨论了针对用户资源的限制以及增强容器的安全隔离措施。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

查看容器内存限制

[root@server1 memory]# docker run -it --name vm1 ubuntu

[root@server1 docker]# pwd
/sys/fs/cgroup/memory/docker

[root@server1 docker]# cd 1ed2c24597bd15280779279f459a6c9ae8777ed807cd623f537c3a5f5ad46c44/
[root@server1 1ed2c24597bd15280779279f459a6c9ae8777ed807cd623f537c3a5f5ad46c44]# cat memory.limit_in_bytes 
9223372036854771712

查看cpu限制并更改

cpu.cfs_period_us 就是时间周期，默认为 100000，即百毫秒。
cpu.cfs_quota_us 就是在这期间内可使用的 cpu 时间，默认 -1，即无限制

[root@server1 cpu]# pwd
/sys/fs/cgroup/cpu
[root@server1 cpu]# mkdir x1
[root@server1 cpu]# cd x1/
[root@server1 x1]# ls
cgroup.clone_children  cpuacct.usage_percpu  cpu.shares
cgroup.event_control   cpu.cfs_period_us     cpu.stat
cgroup.procs           cpu.cfs_quota_us      notify_on_release
cpuacct.stat           cpu.rt_period_us      tasks
cpuacct.usage          cpu.rt_runtime_us
[root@server1 x1]# cat cpu.cfs_period_us 
100000
[root@server1 x1]# cat cpu.cfs_quota_us 
-1


查看是否使用cpu 

[root@server1 cpu]# pwd
/sys/devices/system/cpu
[root@server1 cpu]# cd cpu0/
[root@server1 cpu0]# cat online    ##置0可关闭
1

[root@server1 x1]# echo 20000 > cpu.cfs_quota_us 
[root@server1 x1]# dd if=/dev/zero of=/dev/null &
[1] 2588
[root@server1 x1]# top
 2588 root      20   0  107940    604    516 R 99.7  0.1   0:10.23 dd 
[root@server1 x1]# echo 2588 > tasks 
[root@server1 x1]# top 
 2588 root      20   0  107940    604    516 R 20.0  0.1   0:42.28 dd

内存限制

memory.memsw.limit_in_bytes:内存+swap空间使用的总量限制。 
memory.limit_in_bytes:内存使用量限制

[root@server1 memory]# mkdir x2
[root@server1 x2]# pwd
/sys/fs/cgroup/memory/x2

[root@server1 x2]# cat memory.limit_in_bytes 
9223372036854771712
[root@server1 x2]# echo 314572800 > memory.limit_in_bytes 
[root@server1 x2]# cd /dev/shm/
[root@server1 shm]# ls
[root@server1 shm]# dd if=/dev/zero of=bigfile bs=1M count=400
400+0 records in
400+0 records out
419430400 bytes (419 MB) copied, 0.244224 s, 1.7 GB/s
发现无法限制

[root@server1 shm]# yum search cgroup
[root@server1 shm]# yum install libcgroup-tools.x86_64 -y
[root@server1 shm]# free -m
              total        used        free      shared  buff/cache   available
Mem:            992         125         525           7         341         710
Swap:          1023           5        1018
[root@server1 shm]# cgexec -g memory:x2 dd if=/dev/zero of=bigfile bs=1M count=400
400+0 records in
400+0 records out
419430400 bytes (419 MB) copied, 0.245783 s, 1.7 GB/s
[root@server1 shm]# free -m
              total        used        free      shared  buff/cache   available
Mem:            992         129         226         301         636         410
Swap:          1023         111         912



[root@server1 shm]# cd /sys/fs/cgroup/memory/x2/
[root@server1 x2]# cat memory.memsw.limit_in_bytes 
9223372036854771712

[root@server1 shm]# rm -f bigfile 
[root@server1 x2]# echo 314572800 > memory.memsw.limit_in_bytes

[root@server1 shm]# cgexec -g memory:x2 dd if=/dev/zero of=bigfile bs=1M count=400
Killed
[root@server1 shm]# du bigfile 
306076	bigfile

容器资源限制
限制cpu

[root@server1 cgroup]# docker run -it --name vm2 --cpu-period=100000 --cpu-quota=20000 ubuntu
root@1ba4794048a9:/# [root@server1 cgroup]# 
[root@server1 cgroup]# docker con
config     container  
[root@server1 cgroup]# docker container attach vm2
root@1ba4794048a9:/# 
root@1ba4794048a9:/# dd if=/dev/zero of=/dev/null &
[1] 15
root@1ba4794048a9:/# top
   15 root      20   0    4368    356    280 R 20.3  0.0   0:02.56 dd

[root@server1 1ba4794048a9e0a013a5c61f43e2230c0172fe03779dc32a6b3d06b3f32cce56]# cat cpu.cfs_quota_us 
20000
[root@server1 ~]# docker rm -f vm2
vm2

限制内存

[root@server1 ~]# docker run -it --name vm2 --memory=300M --memory-swap=300M ubuntu

用户的资源限制

[root@server1 ~]# useradd devops
[root@server1 ~]# vim /etc/cgrules.conf 
devops          memory          x2/
[root@server1 ~]# systemctl start cgred

增加隔离性

[root@server1 ~]# yum install lxcfs-2.0.5-3.el7.centos.x86_64.rpm  -y
[root@server1 ~]# cd /var/lib/lxcfs/
[root@server1 lxcfs]# ls
[root@server1 lxcfs]# cd 
[root@server1 ~]# lxcfs /var/lib/lxcfs/ &
[1] 4322
[root@server1 ~]# hierarchies:
  0: fd:   5: net_prio,net_cls
  1: fd:   6: devices
  2: fd:   7: blkio
  3: fd:   8: freezer
  4: fd:   9: pids
  5: fd:  10: perf_event
  6: fd:  11: memory
  7: fd:  12: cpuset
  8: fd:  13: cpuacct,cpu
  9: fd:  14: hugetlb
 10: fd:  15: name=systemd
[root@server1 ~]# cd /var/lib/lxcfs/
[root@server1 lxcfs]# ls
cgroup  proc
[root@server1 lxcfs]# cd proc/
[root@server1 proc]# ls
cpuinfo  diskstats  meminfo  stat  swaps  uptime
[root@server1 proc]# docker run -it -m 300m \
> -v /var/lib/lxcfs/proc/cpuinfo:/proc/cpuinfo:rw \
> -v /var/lib/lxcfs/proc/diskstats:/proc/diskstats:rw \
> -v /var/lib/lxcfs/proc/meminfo:/proc/meminfo:rw \
> -v /var/lib/lxcfs/proc/stat:/proc/stat:rw \
> -v /var/lib/lxcfs/proc/swaps:/proc/swaps:rw \
> -v /var/lib/lxcfs/proc/uptime:/proc/uptime:rw \
> ubuntu
root@96ee0e188f91:/# free -m
             total       used       free     shared    buffers     cached
Mem:           300          1        298        191          0          0
-/+ buffers/cache:          0        299
Swap:          300          0        300

容器用户权限设置

[root@server1 proc]# docker rm -f vm1
vm1
[root@server1 proc]# docker run -it --name vm1 --privileged=true ubuntu
root@f5feba179d76:/# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
15: eth0@if16: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever
root@f5feba179d76:/# ip link set down eth0
root@f5feba179d76:/# ipaddr
bash: ipaddr: command not found
root@f5feba179d76:/# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
15: eth0@if16: <BROADCAST,MULTICAST> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
       valid_lft forever preferred_lft forever

因为--privileged=true 权限太大
使用权限白名单机制--cap-add
[root@server1 proc]# docker run -it --cap-add=NET_ADMIN --name vm1 ubuntu