2

I am having trouble setting the 'memlock' system limit in a container that I launch like this:

   docker run -it ubuntu:xenial

Here is what I tried in a nutshell:

In bash terminal session 1:

docker run -it ubuntu:xenial

set /etc/security/limits.conf to include these lines * hard memlock unlimited * soft memlock unlimited

at the end of file.

Then, from another bash terminal on the host 'bash in' to the same container and try doing this:

root@6ae391cfb6de:/# ulimit -l unlimited

I get this error:

bash: ulimit: max locked memory: cannot modify limit: Operation not permitted

DETAILS to reproduce

I am running on MacOS Sierra 10.12.6 / Docker version 18.03.1-ce, build 9ee9f40

Shell #1

macOS> ulimit -l # output of this command is 'unlimited' which shows host ulimits are not the issue OUTPUT IS: unlimited

macOs> docker run -it ubuntu:xenial

commands below are run in xenial-docker-instance launched from above command on Mac in bash shell #1

 cd  # to home directory
 grep limit .bashrc      # check it any session limits are defined at shell startup -- nothing found

 cat >> /etc/security/limits.conf <<EOF
 *                hard    memlock         unlimited
 *                soft    memlock         unlimited
 EOF

Shell #2 on Mac

containerId=`docker ps | grep ubuntu | sed -e's/ .*//'`  # assumes you only have one docker instance of ubuntu running
docker exec -t -i $containerId  bash                     # 'bash in' to ubuntu running container launched in shell #2
ulimit -l 
# output  is 82000    ... huh?
#
# try setting
ulimit -l unlimited
#
#  Nope.. i get this error: 
#       bash: ulimit: max locked memory: cannot modify limit: Operation not permitted

End: DETAILS to reproduce

Any tips or guidance gratefully appreciated.

2 Answers 2

2

My friend Chris Cellucci gave me the answer: run with --privileged

I will expand on this with more detail today or tomorrow.

3
  • --privileged will add more capabilities than you need. Consider fine tuning to just the ones that you need. Jun 20, 2018 at 23:40
  • good point.. but this is just to make integration tests work, so we are OK with using sledgehammer approach. Jun 22, 2018 at 22:08
  • It is not about the security of the container. It is about the security of the host. The system under test can do what ever it wants, including break the host, steal data… Jun 22, 2018 at 22:11
-1

It would not be good for docker to give this capability.

On Linux my guess is that it is capability CAP_IPC_LOCK.

Why do you need to lock, this is usually not a good idea, or needed. It will not prevent swap on hibernate.

I checked here https://docs.docker.com/docker-for-mac/docker-toolbox/#the-docker-toolbox-environment docker on mac has two version. Both run in a the containers on a linux instance within a virtual machine. Therefore capabilities will be relevant: you will have to add the appropriate capability. See http://man7.org/linux/man-pages/man7/capabilities.7.html

4
  • need lock because datastax docker image will not start without it (datastax distro of cassandra and spark has the requirement for max locked memory = unlimited in their documentation). Our project uses this... so i have no choice. Docker is mac native. Thanks for your reply! Jun 20, 2018 at 16:29
  • Dose mac have a capabilities model, or dose it still use the root is all powerful model? Jun 20, 2018 at 17:25
  • MacOS is bsd based.. I know that. Not sure how that maps to whether it uses capabilities model or not. Jun 20, 2018 at 20:17
  • I have looked up how docker works on MAC, and added some info to my answer. Jun 20, 2018 at 23:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .