Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I have an LXC container running docker. Many containers are running successfully but I am unable to add more; I am trying to deploy a new docker container and getting the following error:
container init caused "join session keyring: create session key: disk quote exceeded": unknown
But the container has plenty of free space, as does the host. I confirmed this with df -h and df -i (so, it's not inodes)
What does this error mean and how is it resolved?
It's not the root filesystem that's the issue here, it's the kernel keyring. This LXC thread explains it well, and has the following solution: on the LXC host (not inside the LXC container), raise the maximum number of keys with:
echo 5000 | sudo tee /proc/sys/kernel/keys/maxkeys
5000 is admittedly arbitrary; select a number that's greater than what you have now.
Quoting Stéphane Graber, maintainer of LXD, from the thread:
Kinda sounds like Docker may be attempting to use the kernel keyring? That’d certainly be a new behavior from them…
and credit to simos also from that thread for the provided command, which resolved this for me.
To add to @Josh's answer. To make this change persist after a reboot you can create a file under /etc/sysctl.d with the updated kernel value
# /etc/sysctl.d/99-custom.conf
kernel.keys.maxkeys=2000
If you are starting a lot of nested containers or unprivileged containers, then you may start to have a lot of processes owned by your mapped user, e.g., UID 1000000.
