552b636939
The value given to --ulimit is passed to the container unchanged and is interpreted by setrlimit(2), so size limits such as memlock are in bytes. The ulimit shell builtin scales most of those values when printing them (kbytes for -d, -l, -m, -s, 512-byte blocks for -c, -f), which makes the value reported inside the container look wrong. Document the unit used by each limit type, add an example, and note that unit suffixes are not accepted. No behavior change. Fixes: #25236 Signed-off-by: i-OmSharma <sharmaom1201@gmail.com>
2.1 KiB
####> This option file is used in: ####> podman podman-container.unit.5.md.in, create, run, update ####> If file is edited, make sure the changes ####> are applicable to all of those. << if is_quadlet >>
Ulimit=option
<< else >>
--ulimit=option
<< endif >>
Ulimit options. Sets the ulimits values inside of the container.
--ulimit with a soft and hard limit in the format =[:]. For example:
$ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n 1024
Here is the list of the different resources and the limits' units:
| Type | Unit of the value given to --ulimit |
|---|---|
| core, fsize | bytes |
| data, memlock, rss, stack | bytes |
| msgqueue | bytes |
| rttime | microseconds |
| cpu | seconds |
| locks, nice, nofile, nproc, rtprio, sigpending | count |
For example, a locked memory limit given in bytes is reported in kbytes:
$ podman run --ulimit memlock=4096 --rm ubi9 ulimit -l 4
Unit suffixes such as k or m are not accepted.
Set -1 for the soft or hard limit to set the limit to the maximum limit of the current process. In rootful mode this is often unlimited.
If nofile is unset, a default value of 1048576 will be used, unless overridden in containers.conf(5). However, if the default value exceeds the hard limit for the current rootless user, the current hard limit will be applied instead.
Use host to copy the current configuration from the host.
Don't use nproc with the ulimit flag as Linux uses nproc to set the maximum number of processes available to a user, not to a container.
Use the --pids-limit option to modify the cgroup control to limit the number of processes within a container.