82406ad958
systemd-2.28 introduced DefaultTasksMax which is used to control
the default TasksMax= setting for services and scopes running on the
system. (TasksMax= is the primary setting that exposes the "pids"
cgroup controller on systemd and was introduced in the previous
systemd release.) The setting now defaults to 512, which means
services that are not explicitly configured otherwise will only
be able to create 512 processes or threads at maximum, from this
version on. However, the 512 limit seems too strict and sometimes
leads to failures like the following one on busy containers
==> opensuse422: fatal: [container3]: FAILED! => {"changed": false, "cmd": "/usr/sbin/rabbitmqctl -q -n '' list_user_permissions guest", "failed": true, "msg": "/usr/sbin/rabbitmqctl: fork: retry: No child processes\n/usr/lib64/rabbitmq/lib/rabbitmq_server-3.6.6//sbin/rabbitmq-env: fork: retry: Resource temporarily unavailable\n/usr/lib64/rabbitmq/lib/rabbitmq_server-3.6.6//sbin/rabbitmq-env: fork: retry: No child processes\n/usr/lib64/rabbitmq/lib/rabbitmq_server-3.6.6//sbin/rabbitmq-env: fork: retry: No child processes\nFailed to create thread: Resource temporarily unavailable (11)\r\nAborted (core dumped)", "rc": 134, "stderr": "/usr/sbin/rabbitmqctl: fork: retry: No child processes\n/usr/lib64/rabbitmq/lib/rabbitmq_server-3.6.6//sbin/rabbitmq-env: fork: retry: Resource temporarily unavailable\n/usr/lib64/rabbitmq/lib/rabbitmq_server-3.6.6//sbin/rabbitmq-env: fork: retry: No child processes\n/usr/lib64/rabbitmq/lib/rabbitmq_server-3.6.6//sbin/rabbitmq-env: fork: retry: No child processes\nFailed to create thread: Resource temporarily unavailable (11)\r\nAborted (core dumped)\n", "stderr_lines": ["/usr/sbin/rabbitmqctl: fork: retry: No child processes", "/usr/lib64/rabbitmq/lib/rabbitmq_server-3.6.6//sbin/rabbitmq-env: fork: retry: Resource temporarily unavailable", "/usr/lib64/rabbitmq/lib/rabbitmq_server-3.6.6//sbin/rabbitmq-env: fork: retry: No child processes", "/usr/lib64/rabbitmq/lib/rabbitmq_server-3.6.6//sbin/rabbitmq-env: fork: retry: No child processes", "Failed to create thread: Resource temporarily unavailable (11)", "Aborted (core dumped)"], "stdout": "", "stdout_lines": []}
and with messages in the kernel log such as
[ 2925.999021] cgroup: fork rejected by pids controller in /init.scope/lxc/container1
[ 3083.704049] cgroup: fork rejected by pids controller in /init.scope/lxc/container2
As we see, even though the /init.scope/lxc/container1 as pids.max set to 'max', the /init.scope
has pids.max set to 512 and in cgroups we always respect the lowest
boundary
~> cat /sys/fs/cgroup/pids/init.scope/lxc/container1/pids.max
max
~> cat /sys/fs/cgroup/pids/init.scope/pids.max
512
As a result of which, the 512 limit is enforced.
As such, we add a new variable to make this limit configurable. The
default limit has now been increased to 8192.
Change-Id: I8b4143aac84d4c795cab9c0d978c9a97ebea1793
73 lines
2.1 KiB
YAML
73 lines
2.1 KiB
YAML
---
|
|
# Copyright 2016, Rackspace US, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
- name: Ensure the lxc dnsmasq user exists
|
|
user:
|
|
name: "{{ lxc_net_dnsmasq_user }}"
|
|
comment: "LXC dnsmasq"
|
|
system: "yes"
|
|
shell: "/bin/false"
|
|
home: "/var/lib/lxc"
|
|
tags:
|
|
- lxc-dnsmasq-user
|
|
|
|
- name: Drop base config file(s)
|
|
template:
|
|
src: "{{ item.src }}"
|
|
dest: "{{ item.dest }}"
|
|
owner: "{{ item.owner|default('root') }}"
|
|
group: "{{ item.group|default('root') }}"
|
|
mode: "{{ item.mode|default('0644') }}"
|
|
with_items:
|
|
- { src: lxc-openstack.conf.j2, dest: "/etc/lxc/lxc-openstack.conf" }
|
|
- { src: default.conf.j2, dest: "/etc/lxc/default.conf" }
|
|
- { src: lxc.default.j2, dest: "{{ system_config_dir}}/lxc-net", mode: "0644" }
|
|
- { src: lxc-system-manage.j2, dest: "/usr/local/bin/lxc-system-manage", mode: "0755" }
|
|
tags:
|
|
- lxc-files
|
|
- lxc-config
|
|
|
|
- name: Drop lxc veth check script
|
|
copy:
|
|
src: "lxc-veth-check.sh"
|
|
dest: "/usr/local/bin/lxc-veth-check"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: "0755"
|
|
tags:
|
|
- lxc-files
|
|
- lxc-config
|
|
|
|
- name: Set systemd DefaultTasksMax value
|
|
lineinfile:
|
|
dest: /etc/systemd/system.conf
|
|
state: present
|
|
regexp: "^.*DefaultTasksMax.*$"
|
|
line: "DefaultTasksMax={{ lxc_default_tasks_max }} # Managed by Ansible"
|
|
when:
|
|
- ansible_service_mgr == 'systemd'
|
|
notify:
|
|
- Reload systemd units
|
|
tags:
|
|
- lxc-config
|
|
|
|
# Ensure apparmor reindex runs before other things that may fail
|
|
- meta: flush_handlers
|
|
|
|
- include: lxc_selinux.yml
|
|
when:
|
|
- ansible_selinux.status is defined
|
|
- ansible_selinux.status == "enabled"
|