From rvansa at azul.com  Mon Nov 27 14:19:43 2023
From: rvansa at azul.com (Radim Vansa)
Date: Mon, 27 Nov 2023 15:19:43 +0100
Subject: Detecting resource limits with cgroups v2
Message-ID: <681da959-3cee-486a-af27-743ecb88a727@azul.com>

Hello,

I'd like to ask if there are any plans on detecting effective resource 
limits with cgroups v2, in JVM. The limits placed on a higher level in 
cgroups cannot be exceeded in descendants; however, JVM currently reads 
only the limits imposed in the leaf node. The detection can be traced using

java -XshowSettings:system -Xlog:os+container=trace -version

others have observed this as well [1]. Therefore, if the limit is 
imposed higher (e.g. on the whole user.slice) JVM won't know about it. I 
believe that the container awareness introduced in JDK-8182070 [2] makes 
it quite explicit that the span of support is intended only for Docker 
(therefore, other container runtimes or baremetal with manual cgroup 
changes excluded), and Docker imposes the limits directly on the cgroup 
the container is run in. This means that the lack of awareness about the 
higher level is not a bug, rather a missing feature.

Are there any plans on supporting this? I guess that traversing the 
whole hierarchy would have some performance impact (though reading the 
cgroup limits is already throttled), are there any other concerns to 
traversing the ancestors?

Thanks!

Radim Vansa


[1] https://stackoverflow.com/a/77234728/789756

[2] https://bugs.openjdk.org/browse/JDK-8182070


From sgehwolf at redhat.com  Tue Nov 28 11:29:09 2023
From: sgehwolf at redhat.com (Severin Gehwolf)
Date: Tue, 28 Nov 2023 12:29:09 +0100
Subject: Detecting resource limits with cgroups v2
In-Reply-To: <681da959-3cee-486a-af27-743ecb88a727@azul.com>
References: <681da959-3cee-486a-af27-743ecb88a727@azul.com>
Message-ID: <06706ee926bb9580c415592fbf4ac3f00398e37f.camel@redhat.com>

Hi,

On Mon, 2023-11-27 at 15:19 +0100, Radim Vansa wrote:
> Hello,
> 
> I'd like to ask if there are any plans on detecting effective resource 
> limits with cgroups v2, in JVM. The limits placed on a higher level in 
> cgroups cannot be exceeded in descendants; however, JVM currently reads 
> only the limits imposed in the leaf node. The detection can be traced using
> 
> java -XshowSettings:system -Xlog:os+container=trace -version
> 
> others have observed this as well [1]. Therefore, if the limit is 
> imposed higher (e.g. on the whole user.slice) JVM won't know about it. I 
> believe that the container awareness introduced in JDK-8182070 [2] makes 
> it quite explicit that the span of support is intended only for Docker 
> (therefore, other container runtimes or baremetal with manual cgroup 
> changes excluded), and Docker imposes the limits directly on the cgroup 
> the container is run in. This means that the lack of awareness about the 
> higher level is not a bug, rather a missing feature.
> 
> Are there any plans on supporting this?

Not yet, but there should be. Happy to work with you on it. Could you
please file an enhancement bug?

> I guess that traversing the 
> whole hierarchy would have some performance impact (though reading the 
> cgroup limits is already throttled), are there any other concerns to 
> traversing the ancestors?

I think it would be sufficient to figure out the hierarchy when we
first set the path to the interface files. I.e. set it to the path
where the lowest limit is being set.

It would also be good to understand how we could mimic such a setup so
we can test this properly.

Thanks,
Severin

> Thanks!
> 
> Radim Vansa
> 
> 
> [1] https://stackoverflow.com/a/77234728/789756
> 
> [2] https://bugs.openjdk.org/browse/JDK-8182070
>