Adjusted hard and soft nofile limits on the host to 100000, launched container and observed lower nofile limits in prlimit. Upgraded systemd in the container from 229-4ubuntu17 to 229-4ubuntu18. Rebooted the container and observed much higher nofile limits.
** Tags removed: verification-needed verification-needed-xenial ** Tags added: verification-done verification-done-xenial -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to systemd in Ubuntu. https://bugs.launchpad.net/bugs/1686361 Title: systemd does not respect nofile ulimit when running in container Status in systemd package in Ubuntu: Fix Released Status in systemd source package in Xenial: Fix Committed Status in systemd source package in Yakkety: In Progress Status in systemd source package in Zesty: Fix Released Status in systemd source package in Artful: Fix Released Bug description: [Impact] * Containers cannot use maximum RLIMIT_NOFILE, because systemd sets an arbitrary cap. [Test Case] * Start container with high RLIMIT_NOFILE (e.g. 100 000) * Check that RLIMIT_NOFILE on the container is more than 65536 [Regression Potential] * This is a feature / change of behaviour. Some users may be relying on the lower RLIMIT_NOFILE cap, but it should not have a negative impact on the host (as in creating too many file descriptors/denial of service). [Original Bug Report] When systemd currently starts in a container that has RLIMIT_NOFILE set to e.g. 100000 systemd will lower it to 65536 since this value is hard-coded into systemd. I've pushed a patch to systemd upstream that will try to set the nofile limit to the allowed kernel maximum. If this fails, it will compute the minimum of the current set value (the limit that is set on the container) and the maximum value as soft limit and the currently set maximum value as the maximum value. This way it retains the limit set on the container. It would be great if we could backport this patch to have system adhere to nofile limits set for the container. This is especially important since user namespaces will allow you to lower the limit but not raise it back up afterwards. The upstream patch is appended. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1686361/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
