lxc.cgroup.cpuset.cpus not being respected

[Jim O]

I'msing Proxmox 4.1 with uname-r 4.2.6-1-pve.

I have tried the following setting in /var/lib/lxc/103/config :

lxc.cgroup.cpuset.cpus = 0,1

Unfortunately I see all of the host's CPU's in "top" and in "cat /proc/cpuinfo"

If I run "lxc-cgroup -n 103 cpuset.cpus 0,1" on the host it has the desired effect and I see only the two CPU's in "top" and in "cat /proc/cpuinfo".

Is this a known bug? Any workaround besides using the command line in the host?

 

[dietmar]

This is expected behavior - we limit the CPU time you get, not the number of CPUs.

 

[Jim O]

The command (and knob) is there for a reason as per https://linuxcontainers.org/lxc/manpages/man1/lxc-cgroup.1.html.

If they don't work, that's not exactly "expected" behavior, it's a bug. Unless of course it's specifically disabled, in which case I'd call it a "feature".

 

[dietmar]

It works. Overall CPU usage is limited.

 

[Jim O]

Sir, a very wise former United States senator and diplomat once said (I'll paraphrase) that people are entitled to their own opinions but not to their own facts.

We can agree to disagree on whether it "works", and perhaps we understand that word differently. If, as in this case, a tool "works" as expected from the command line but the same tool does NOT work when placed in the config file, that is not something that "works". The first part of that sentence is the facts, the last part is my opinion. With all due respect, your opinion goes against the facts. This tool is designed to limit a specific container to a specific CPU core or to a group of CPU cores. It's different from limiting overall CPU access. I want my customers only seeing a certain number of CPU's for which they have paid. I do not want them having that much information regarding the host and I do not want their processes necessarily interfering with other containers on the same host. That is is (at least one) purpose of the command. It "works" as expected when executed from the command line. It does not work at all when placed in the config file.

Peace, out.

 

[dietmar]

SThis tool is designed to limit a specific container to a specific CPU core or to a group of CPU cores. It's different from limiting overall CPU access.

OH, I see - you manually limit the number of cpus using lxc.cgroup.cpuset.cpus. I personally would not do that, because it pins your container to those specific CPUs - but I guess there is a use case.

Besides, you need to add custom lxc setting in /etc/pve/lxc/<CTID>.conf. Everything works as expected if you do that.

 

[Jim O]

Placing that line in /etc/pve/lxc/103.conf has no effect on container 103. All of the host's CPU cores still show in the container.

 

[wbumiller]

Works here, you also have to restart the container as manual changes to the /etc/pve files don't get hot-applied by us.
(At startup the config in /var/lib/lxc gets replaced with the data from the one in /etc/pve/lxc)

 

[Jim O]

Works here, you also have to restart the container as manual changes to the /etc/pve files don't get hot-applied by us.
(At startup the config in /var/lib/lxc gets replaced with the data from the one in /etc/pve/lxc)

My mistake. I had rebooted from within the container. Rebooting the container from the host did produce the desired effect. Thanks!

 

[sahostking]

does it still show the hosts cpu usage though or just the containers?