Limit a container‘s resources

默认情况下，一个容器没有资源限制，几乎可以使用宿主主机的所有资源。
docker提供了控制内存、cpu、block io。但是实际上只有前两个可以控制。
依赖linux内核支持。

namespace和ccgroup

Memory
OOME
内核发现主机没有足够的内存使用，他就会发生oome，就会kill进程，释放内存。
1、一旦发生oome，任何进程都有可能被杀死，包含docker daemon在内。
2、docker特性地调整了docker daemon的OOM优先级，以避免他被内存杀掉，但容器的优先级并未被调整。

Limit a container‘s access to memory 详细情况看图
option
-m or --memory=
--memory-swap 这个依赖于上面那个 有张图可以看看
--memory-swappiness
--memory-reservatiop
--kernel-memory
--oom-kill-disable

CPU

默认情况下，每个容器可以使用宿主主机上所有的cpu资源
很多种变化的设置
cfs scheduler    调度，完全公平调度器
docker 1.13或者更高的版本，有实时调度器

1024：512：2048：1024

option
--cpus=<values>      核心数量，可以是小数如1.5
--cpu-period=<values>
--cpu-quota=<values>
--cpuset-cpus         范围

=======================================================
[root@master ~]# docker run --help

Usage: docker run [OPTIONS] IMAGE [COMMAND] [ARG...]

Run a command in a new container

Options:

  --add-host list                  Add a custom host-to-IP mapping (host:ip)

-a, --attach list Attach to STDIN, STDOUT or STDERR

  --blkio-weight uint16            Block IO (relative weight), between 10 and 1000, or 0 to disable (default 0)
  --blkio-weight-device list       Block IO weight (relative device weight) (default [])
  --cap-add list                   Add Linux capabilities
  --cap-drop list                  Drop Linux capabilities
  --cgroup-parent string           Optional parent cgroup for the container
  --cidfile string                 Write the container ID to the file
  --cpu-period int                 Limit CPU CFS (Completely Fair Scheduler) period
  --cpu-quota int                  Limit CPU CFS (Completely Fair Scheduler) quota
  --cpu-rt-period int              Limit CPU real-time period in microseconds
  --cpu-rt-runtime int             Limit CPU real-time runtime in microseconds

-c, --cpu-shares int CPU shares (relative weight)

  --cpus decimal                   Number of CPUs
  --cpuset-cpus string             CPUs in which to allow execution (0-3, 0,1)
  --cpuset-mems string             MEMs in which to allow execution (0-3, 0,1)

-d, --detach Run container in background and print container ID

  --detach-keys string             Override the key sequence for detaching a container
  --device list                    Add a host device to the container
  --device-cgroup-rule list        Add a rule to the cgroup allowed devices list
  --device-read-bps list           Limit read rate (bytes per second) from a device (default [])
  --device-read-iops list          Limit read rate (IO per second) from a device (default [])
  --device-write-bps list          Limit write rate (bytes per second) to a device (default [])
  --device-write-iops list         Limit write rate (IO per second) to a device (default [])
  --disable-content-trust          Skip image verification (default true)
  --dns list                       Set custom DNS servers
  --dns-option list                Set DNS options
  --dns-search list                Set custom DNS search domains
  --entrypoint string              Overwrite the default ENTRYPOINT of the image

-e, --env list Set environment variables

  --env-file list                  Read in a file of environment variables
  --expose list                    Expose a port or a range of ports
  --group-add list                 Add additional groups to join
  --health-cmd string              Command to run to check health
  --health-interval duration       Time between running the check (ms|s|m|h) (default 0s)
  --health-retries int             Consecutive failures needed to report unhealthy
  --health-start-period duration   Start period for the container to initialize before starting health-retries countdown (ms|s|m|h) (default 0s)
  --health-timeout duration        Maximum time to allow one check to run (ms|s|m|h) (default 0s)
  --help                           Print usage

-h, --hostname string Container host name

  --init                           Run an init inside the container that forwards signals and reaps processes

-i, --interactive Keep STDIN open even if not attached

  --ip string                      IPv4 address (e.g., 172.30.100.104)
  --ip6 string                     IPv6 address (e.g., 2001:db8::33)
  --ipc string                     IPC mode to use
  --isolation string               Container isolation technology
  --kernel-memory bytes            Kernel memory limit

-l, --label list Set meta data on a container

  --label-file list                Read in a line delimited file of labels
  --link list                      Add link to another container
  --link-local-ip list             Container IPv4/IPv6 link-local addresses
  --log-driver string              Logging driver for the container
  --log-opt list                   Log driver options
  --mac-address string             Container MAC address (e.g., 92:d0:c6:0a:29:33)

-m, --memory bytes Memory limit

  --memory-reservation bytes       Memory soft limit
  --memory-swap bytes              Swap limit equal to memory plus swap: '-1' to enable unlimited swap
  --memory-swappiness int          Tune container memory swappiness (0 to 100) (default -1)
  --mount mount                    Attach a filesystem mount to the container
  --name string                    Assign a name to the container
  --network string                 Connect a container to a network (default "default")
  --network-alias list             Add network-scoped alias for the container
  --no-healthcheck                 Disable any container-specified HEALTHCHECK
  --oom-kill-disable               Disable OOM Killer
  --oom-score-adj int              Tune host's OOM preferences (-1000 to 1000)
  --pid string                     PID namespace to use
  --pids-limit int                 Tune container pids limit (set -1 for unlimited)
  --privileged                     Give extended privileges to this container

-p, --publish list Publish a container's port(s) to the host
-P, --publish-all Publish all exposed ports to random ports

  --read-only                      Mount the container's root filesystem as read only
  --restart string                 Restart policy to apply when a container exits (default "no")
  --rm                             Automatically remove the container when it exits
  --runtime string                 Runtime to use for this container
  --security-opt list              Security Options
  --shm-size bytes                 Size of /dev/shm
  --sig-proxy                      Proxy received signals to the process (default true)
  --stop-signal string             Signal to stop a container (default "SIGTERM")
  --stop-timeout int               Timeout (in seconds) to stop a container
  --storage-opt list               Storage driver options for the container
  --sysctl map                     Sysctl options (default map[])
  --tmpfs list                     Mount a tmpfs directory

-t, --tty Allocate a pseudo-TTY

  --ulimit ulimit                  Ulimit options (default [])

-u, --user string Username or UID (format: <name|uid>[:<group|gid>])

  --userns string                  User namespace to use
  --uts string                     UTS namespace to use

-v, --volume list Bind mount a volume

  --volume-driver string           Optional volume driver for the container
  --volumes-from list              Mount volumes from the specified container(s)

-w, --workdir string Working directory inside the container

[root@master ~]# docker pull lorel/docker-stress-ng

内存限制
[root@master ~]# docker run --name stress -it --rm -m 256m lorel/docker-stress-ng:latest stress --vm 2
stress-ng: info: [1] defaulting to a 86400 second run per stressor
stress-ng: info: [1] dispatching hogs: 2 vm

使用以下命令查看资源使用情况
[root@master ~]# docker top stress
UID PID PPID C STIME TTY TIME CMD
root 28340 28292 1 22:21 pts/0 00:00:00 /usr/bin/stress-ng stress --vm 2
root 28432 28340 0 22:21 pts/0 00:00:00 /usr/bin/stress-ng stress --vm 2
root 28433 28340 0 22:21 pts/0 00:00:00 /usr/bin/stress-ng stress --vm 2
root 28436 28432 18 22:21 pts/0 00:00:00 /usr/bin/stress-ng stress --vm 2
root 28442 28433 18 22:21 pts/0 00:00:00 /usr/bin/stress-ng stress --vm 2

cpu核心限制

[root@master ~]# docker run --name stress -it --rm --cpus 2 lorel/docker-stress-ng:latest stress --cpu 2
stress-ng: info: [1] defaulting to a 86400 second run per stressor
stress-ng: info: [1] dispatching hogs: 2 cpu
[root@master ~]# docker top stress
UID PID PPID C STIME TTY TIME CMD
root 30929 30911 0 22:25 pts/0 00:00:00 /usr/bin/stress-ng stress --cpu 2
root 30968 30929 89 22:25 pts/0 00:00:07 /usr/bin/stress-ng stress --cpu 2
root 30969 30929 89 22:25 pts/0 00:00:07 /usr/bin/stress-ng stress --cpu 2

[root@master ~]# docker stats stress
CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS
15fc3d72498a stress 199.36% 3.996MiB / 7.64GiB 0.05% 648B / 0B 0B / 0B 0

运行在那个核心上
[root@master ~]# docker run --name stress -it --rm --cpuset-cpus 0,2 lorel/docker-stress-ng:latest stress --cpu 2

资源对比
[root@master ~]# docker run --name stress01 -it --rm --cpu-shares 1024 lorel/docker-stress-ng:latest stress --cpu 2
[root@master ~]# docker run --name stress02 -it --rm --cpu-shares 512 lorel/docker-stress-ng:latest stress --cpu 2