45

So I have 4 GB RAM + 4GB swap. I want to create a user with limited ram and swap: 3 GB RAM and 1 GB swap. Is such thing possible? Is it possible to start applications with limited RAM and swap avaliable to them without creating a separate user (and not installing any special apps - having just a default Debian/CentOS server configuration, and not using sudo)?

Update:

So I opened terminall and typed into it ulimit command: ulimit -v 1000000 which shall be like 976,6Mb limitation. Next I called ulimit -a and saw that limitation is "on". Then I started some bash script that compiles and starts my app in nohup, a long one nohup ./cloud-updater-linux.sh >& /dev/null &... but after some time I saw:

enter image description here

(which would be ok if no limitations were applied - it downloaded some large lib, and started to compile it.)

But I thought I applied limitations to the shell and all processes launched with/from it with ulimit -v 1000000? What did I get wrong? How to make a terminal and all sub processes it launches be limited on ram usage?

  • 1
    You can't put memory restrictions on a user as a whole, only on each process. And you can't distinguish between RAM and swap usage. If you want finer control, run the user's processes in a virtual machine. – Gilles 'SO- stop being evil' Mar 16 '12 at 23:30
  • @Gilles pretty sure that virtual machines just use cgroups and namespaces, or derivatives of – RapidWebs Aug 15 '14 at 0:38
  • @RapidWebs no they don't. They just emulate the predefined amount of RAM, and the guest OS then decides how to allocate it to the processes. – Ruslan Aug 10 '16 at 16:18
  • Containers (not virtual machines) use cgroups, to limit memory usage. Limiting virtual memory is not a good idea; A process can use a lot of virtual memory, but may only use a little RAM. For example my system has 34359738367 kB of virtual memory allocated, but much less ram. – ctrl-alt-delor Dec 10 '18 at 20:12
65

ulimit is made for this. You can setup defaults for ulimit on a per user or a per group basis in

/etc/security/limits.conf

ulimit -v KBYTES sets max virtual memory size. I don't think you can give a max amount of swap. It's just a limit on the amount of virtual memory the user can use.

So you limits.conf would have the line (to a maximum of 4G of memory)

luser  hard  as   4000000

UPDATE - CGroups

The limits imposed by ulimit and limits.conf is per process. I definitely wasn't clear on that point.

If you want to limit the total amount of memory a users uses (which is what you asked). You want to use cgroups.

In /etc/cgconfig.conf:

group memlimit {
    memory {
        memory.limit_in_bytes = 4294967296;
    }
}

This creates a cgroup that has a max memory limit of 4GiB.

In /etc/cgrules.conf:

luser   memory   memlimit/

This will cause all processes run by luser to be run inside the memlimit cgroups created in cgconfig.conf.

  • is such thing settable on useradd? – myWallJSON Mar 16 '12 at 13:41
  • 4
    @myWallJSON Not directly, but you can immediately add it to limits.conf, or you can setup a group with certain limits in limits.conf and add user to that group. – utopiabound Mar 16 '12 at 14:56
  • 1
    That's awesome! I didn't know you could do this! Great answer +1 – Yanick Girouard Mar 16 '12 at 16:50
  • 1
    @utopiabound: Updated my Q with some data I got trying to use ulimit. – myWallJSON Mar 16 '12 at 22:24
  • 1
    @f.ardelian Upgrade the kernel. Here's an article about how to do just that! – Daniel C. Sobral Feb 11 '13 at 1:05
4

You cannot cap memory usage at the user level, ulimit can do that but for a single process.

Even with using per user limits in /etc/security/limits.conf, a user can use all memory by running multiple processes.

Should you really want to cap resources, you need to use a resource management tool, like rcapd used by projects and zones under Solaris.

There is something that seems to provide similar features on Linux that you might investigate: cgroups.

  • Well, I suppose setting a cap on users login shell or something like that could be interpreted as "setting a limit for the user", since all processes would inherit from that shell? – amn Apr 18 '16 at 14:31
  • 1
    @amn It won't. A user might simply open a new login shell to workaround such a limit. – jlliagre Apr 18 '16 at 14:46
  • Right, that invalidates my assumption alright. – amn Apr 18 '16 at 16:24
4

cgroups are the right way to do this, as other answers have pointed out. Unfortunately there is no perfect solution to the problem, as we'll get into below. There are a bunch of different ways to set cgroup memory usage limits. How one goes about making a user's login session automatically part of a cgroup varies from system to system. Red Hat has some tools, and so does systemd.

memory.memsw.limit_in_bytes and memory.limit_in_bytes set limits including and not including swap, respectively. The downside memory.limit_in_bytes is that it counts files cached by the kernel on behalf of processes in the cgroup against the group's quota. Less caching means more disk access, so you're potentially giving up some performance if the system otherwise had some memory available.

On the other hand, memory.soft_limit_in_bytes allows the cgroup to go over-quota, but if the kernel OOM killer gets invoked then those cgroups which are over their quotas get killed first, logically. The downside of that, however, is that there are situations where some memory is needed immediately and there isn't time for the OOM killer to look around for processes to kill, in which case something might fail before the over-quota user's processes are killed.

ulimit, however, is absolutely the wrong tool for this. ulimit places limits on virtual memory usage, which is almost certainly not what you want. Many real-world applications use far more virtual memory than physical memory. Most garbage-collected runtimes (Java, Go) work this way to avoid fragmentation. A trivial "hello world" program in C, if compiled with address sanitizer, can use 20TB of virtual memory. Allocators which do not rely on sbrk, such as jemalloc (which is the default allocator for Rust) or tcmalloc, will also have virtual memory usage substantially in excess of their physical usage. For efficiency, many tools will mmap files, which increases virtual usage but not necessarily physical usage. All of my Chrome processes are using 2TB of virtual memory each. I'm on a laptop with 8GB of physical memory. Any way one tried to set up virtual memory quotas here would either break Chrome, force Chrome to disable some security features which rely on allocating (but not using) large amounts of virtual memory, or be completely ineffective at preventing a user from abusing the system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.