Tiny Container Challenge: Building a 6kB Containerized HTTP Server

Re:Tiny Container Challenge: Building a 6kB Containerized HT... by jeffbee on Thursday April 22, 2021 @09:13AM (#26902359)

The incompressible resources, including memory, have the best isolation story, but it is by no means perfect. A process in a given control group can easily cause external memory consumption that either escapes accounting altogether, or is charged to another control group. An example is the way kernel slabs are assigned to control groups. There were some patches in late 2020 from Facebook to help fix this, but I am not sure if they are merged and released yet. Those patches are also just better, not perfect.

Another example is a control group that is chronically out of memory. It may page vigorously, which will have external effects on other control groups through unaccounted resources like nvme controller time, memory fragmentation, global vmscan, etc.

A third popular way to abuse the resources of other containers is through networking. The way Linux handles network traffic is frankly hostile to proportional resource sharing. A control group with zero CPU quota can still easily cause external CPU time consumption.

[ Parent | on HN ]

Re:Tiny Container Challenge: Building a 6kB Containerized HT... by hardwaresofton on Thursday April 22, 2021 @10:36AM (#26903233)

Thanks for explaining, while I still think what you said was a bit hyperbolic, I definitely didn't know about these... externalities, I guess you could call them? Learned something today.

[ Parent | on HN ]

Re:Tiny Container Challenge: Building a 6kB Containerized HT... by jeffbee on Thursday April 22, 2021 @12:38PM (#26904778)

I think of control groups as being adequate for what their inventor intended: approximate sharing of resources between non-antagonistic, first-party processes. Outside of that zone they can't be relied on for much of anything.

[ Parent | on HN ]