LXC containers seems to affect host (Too many open files)

[grenadecx]

First, I have to say I really love proxmox, been using it for a while now and it's impressive. I have recently setup a new machine with latest proxmox 4.2 and seems to have some minor problems.

I'm running 6 LXC containers and I seem to have a lot of problems with inotify hitting it's limit.
The pveproxy service crashed and restarting it gave me:

Jun 16 16:00:36 ns394694 pveproxy[8549]: start failed - Unable to create new inotify object: Too many open files at /usr/share/perl5/PVE/INotify.pm line 389.

It seems that some of my LXC containers have hit a memory limit as well with "cgroup out of memory" errors. Not sure if this is connected with the inotify problem or if that's actually me causing that problem.

I've currently increased the inotify in /etc/sysctl.conf with:

fs.inotify.max_user_instances=8192

So I guess my main question is, how is it that inotify seems to be hitting the limit with running only 6 containers in the first place? Something just doesn't seem right.

The thread below experienced a similar issue but they only increased the inotify to 256, which I did at first because my first round with 4 containers hit that limit. But they are talking about running over 70 containers where I only run 6.
https://forum.proxmox.com/threads/u...too-many-open-files-at-usr-share-perl5.23700/

 

[fabian]

host and containers share one kernel, and that means they also have a shared inotify limit. find out which processes are using up your inotify objects and see if you can keep them in line if you don't want to increase the limit further (http://unix.stackexchange.com/questions/15509/whos-consuming-my-inotify-resources).

 

[grenadecx]

host and containers share one kernel, and that means they also have a shared inotify limit. find out which processes are using up your inotify objects and see if you can keep them in line if you don't want to increase the limit further (http://unix.stackexchange.com/questions/15509/whos-consuming-my-inotify-resources).

I kinda understand, thanks.

I'm wondering however, do OpenVZ containers suffer the same problem, or do they deal with this in a different way?

I was starting to love the containers, but this seems like a big issue since I can't always be in control in what runs on the containers, and if one container can kill the host because of this, it seems like a pretty big issue.