LXC unprivileged containers resource limit issues

LXC
1

Hey,

I recently started using LXC with unprivileged containers on ubuntu 20.04.
But I ran into problems with resource limits via cgroup.

lxc-start container 20200427171713.527 ERROR    cgfsng - cgroups/cgfsng.c:cg_legacy_set_data:2687 - No such file or directory - Failed to setup limits for the "cpuset" controller. The controller seems to be unused by "cgfsng" cgroup driver or not enabled on the cgroup hierarchy
lxc-start container 20200427171713.527 ERROR    cgfsng - cgroups/cgfsng.c:cgfsng_setup_limits_legacy:2731 - No such file or directory - Failed to set "cpuset.cpus" to "1"

the memory limit “works” but it can be exceed anytime, the cpus limitation does not work and it runs into a fatal error.

Anyone got an idea on this?

2

@brauner

3

Your cpuset cgroup isn’t writable for fully unprivileged containers. By default Ubuntu only enables freezer, memory, and name=systemd controllers. You can change that setting by editing:

/etc/pam.d/common-session
/etc/pam.d/common-session-noninteractive

and appending cpuset to the comma-separated controller list on the pam_cgfs.so line.

4

@brauner thanks for the response.
But how is it possible, that I set a memory limit and it gets exceeded, maybe there is also a different problem?

Anyway, I will try what you said and let you know when it works.

5

Can you show how you exceed it? I.e. what limit do you set and how do you determine it is exceeded?

6

@brauner I am switching the stuff to LXD now, so should be solved.