erabo/spiegel_podman
1
0
Fork 0
mirror of https://github.com/podman-container-tools/podman.git synced 2026-08-05 00:15:44 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

test system: increase nproc ulimit to avoid flake

Browse source 
RLIMIT_NPROC is enforced per user namespace, not per container. On
remote with rootless, leaked conmon exec-session processes (which
sleep ~300s) can push the process count in the shared user namespace
high enough that a low nproc ulimit like 512 causes crun to fail with
'clone: Resource temporarily unavailable'. Bump the test value to
10000, with a comment explaining why, so it isn't quietly lowered
again.

Verified locally with:
hack/bats --rootless 280:"podman update - set ulimits"

Fixes: #28940
Signed-off-by: Prachi Gupta <prachig2808@gmail.com>
(cherry picked from commit 74d18c7572)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This commit is contained in:
Prachi Gupta 2026-07-17 03:44:48 +00:00 • committed by Paul Holzinger
parent 004e07ea86
commit c3b1985ce2
No known key found for this signature in database
GPG key ID: EB145DD938A3CAF2
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
test/system/280-update.bats
View file

@ -366,11 +366,17 @@ function nrand() {
assert "$output" =~ "nofile: 1024" "nofile ulimit updated to 1024 in main process"
# Update with multiple ulimits
run_podman update --ulimit nofile=2048:2048 --ulimit nproc=512:512 $ctrname
# nproc is set high (10000) on purpose, not just "safely above default".
# RLIMIT_NPROC is enforced per user *namespace*, not per container, so a
# low value here can flake: on remote, conmon processes for exec
# sessions are leaked and sleep for ~300s, adding to the process count
# in the shared rootless user namespace. Do not lower this without
# reading https://github.com/containers/podman/issues/28940
run_podman update --ulimit nofile=2048:2048 --ulimit nproc=10000:10000 $ctrname
run_podman restart $ctrname
run_podman logs $ctrname
assert "$output" =~ "nofile: 2048" "nofile ulimit updated to 2048 in main process"
assert "$output" =~ "nproc: 512" "nproc ulimit updated to 512 in main process"
assert "$output" =~ "nproc: 10000" "nproc ulimit updated to 10000 in main process"
# Capture host values by running a temporary container with --ulimit host option
run_podman run --rm --ulimit host $IMAGE sh -c "echo 'nofile:' \$(ulimit -n); echo 'nproc:' \$(ulimit -u)"