Using cgroup to limit program memory as it's running

Question

Let's say I have created a cgroup and attach a memory limit of 200MB to the cgroup. I then run a memory-intensive process inside the cgroup, and it uses up its limit of 200MB.

As the process runs, is it possible to lower the memory consumption of the process? So can I set a limit of 100MB while the process is already running and using up 200MB? If so, how quickly does the kernel release 100MB of memory that was being used by the cgroup, and what happens to that memory if the process tries to access it?

Answer 1

Yes, depending on what you mean by "allocated". You can reduce or increase the amount of physical memory that the process can use.

In-use memory consists of, among other things:

• Images from disk which are mapped to the process (e.g. shared libraries, executables)
• Pages from disk which are cached by the IO cache layer
• Anonymous memory which may or may not be backed by swap.

When reducing the cgroup memory.limit_in_bytes the system will discard pages from disk cache and from disk images (e.g. executables), as these can always be reloaded if needed.

If you have swap enabled, it can also page out anonymous memory.

Create a cgroup for your process and set the limit

# Create a cgroup
mkdir /sys/fs/cgroup/memory/my_cgroup
# Add the process to it
echo $PID > /sys/fs/cgroup/memory/my_cgroup/cgroup.procs

# Set the limit to 40MB
echo $((40 * 1024 * 1024)) > /sys/fs/cgroup/memory/my_cgroup/memory.limit_in_bytes

The system will immediately swap things out until it is under the limit, and it will keep doing this to keep the process under the limit.

If it is not possible for the kernel to put the process or group under the limit initially (because certain memory cannot be swapped e.g. if you don't have any swap, or certain kernel pages which might not be swappable), an error will occur, and the limit will not be changed.

If it is not possible to do this at some point in the future, the OOM killer will kill the process (or one of its subprocesses).

You can use the oom_control key to instead suspend the processes in the group, but then you will have to resolve the issue yourself, either by raising the limit or killing one or more processes.

More information

There is also a memory.soft_limit_in_bytes key. This does not invoke the oom killer, rather it is used when the system is under memory pressure to determine which processes get swapped out first (and possibly at other times).

From within the process or group

Processes can be made aware of memory limits by coding them to query the current usage, and the hard and soft limits. They can then take action to avoid breaching the limits, for example by refraining: from allocating memory, creating child processes or accepting new connection; or by reducing usage by e.g. terminating existing connections.

Processes can subscribe to notifications using the cgroups notification API.

See also

Kernel documentation at:

• https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/memory.html#memory-thresholds

Answer 2

No, once a running program has successfully allocated memory, you cannot take it away.

Also note that putting a limit on the memory used by the process will cause the kernel to kill the process in the cgroup using the most memory if the limit is exceeded; it won't cause a memory allocation within the program to fail.