Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs(user/rootless.md) Mention possible pids_limit issues with rootless podman #3687

Merged
merged 1 commit into from
Jul 18, 2024
Merged

docs(user/rootless.md) Mention possible pids_limit issues with rootless podman #3687

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions site/content/docs/user/rootless.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,14 @@ Also, depending on the host configuration, the following steps might be needed:
iptable_nat
```

- If using podman, be aware that by default there is a [limit](https://docs.podman.io/en/v4.3/markdown/options/pids-limit.html#pids-limit-limit) to the number of pids that can be created. This can cause problems like nginx workers inside a container not spawning correctly.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we should probably mention potential downsides as well? (to disabling the limit), users could also set a higher limit instead of no limit?

Copy link
Contributor Author

@netguino netguino Jul 18, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about something like...

If you want to raise this limit, edit your containers.conf file ( generally located in /etc/containers/ ). Note that setting this to 0 will disable the limit, potentially allowing things like pid exhaustion to happen on the host machine.

[containers]
pids_limit=10000

I'm not 100% sure about doing it this way because most people will likely copy the arbitrary number I chose for the block.

Alternatively, I can just go with the current way, but rewrite it like this:

If you want to disable this limit, edit your containers.conf file ( generally located in /etc/containers/ ). Note that this could cause things like pid exhaustion to happen on the host machine. If you prefer, change 0 to your desired maximum number for the new limit.

[containers]
pids_limit=0

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems reasonable to me to show an example using 0, along with that warning about pid exhaustion being a possibility.

But I could also see the inverse. Havintg10000 as the example at least does set some sort of limit. Then there could just be a note stating it is possible to have no limit with 0.

Either approach seems fine to me. Your latest update looks good.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree.

I think we just need to at least mention the risk of exhaustion and the possibility to set a specific higher limit instead, with the alternate downside that it may not be high enough and/or may still enable exhaustion.

I think your sample with 0 is sufficient otherwise. Thank yu!

- If you want to disable this limit, edit your `containers.conf` file (generally located in `/etc/containers/containers.conf`). Note that this could cause things like pid exhaustion to happen on the host machine. Alternatively, change `0` to your desired new limit:

```ini
[containers]
pids_limit = 0
```
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: should hae a blank line before the next heating


## Restrictions

The restrictions of Rootless Docker apply to kind clusters as well.
Expand Down