Will Linux/Ubuntu running in an LXC container understand cgroup memory limits?

Question

I'm planning to rent a physical server and run MySQL inside an LXC container on that server. I'd like to control maximum memory usage for the MySQL instance using cgroup limits :

lxc.cgroup.memory.limit_in_bytes = 8192M

This will effectively control how much memory the container may use, but top or free inside the container will still report overall memory for the LXC host (physical server). I'm not an expert in how Linux manages memory on general, but I assume that - on a physical machine - Linux will begin to swap if it sees that it is about to hit a physical memory limit. Does Linux handle the "effective" memory limit (be it cgroup limit or physical limit) the same way regardless of wether it runs inside a container or on a physical host?

Answer 1

There is no Linux running inside the container, as Linux is the kernel and you share it with the host. Your apps (like free and top) read system info from /proc and thus get details about the host as lxc does not fake the limited resources by default (in contrast to eg OpenVZ). This is ok unless your app behaves differently depending on the ram/swap/cpu numbers. If your app tries to allocate more memory than available to the container it will be OOM-killed as any other app in a non-container environment.

If you want to see the limited resources inside the container, do the following on the host:

apt-get install lxcfs

Afterwards restart the container. LXCFS will emulate a few files in /proc of the container and apps will see the limited resources (cpu, ram, swap) properly.

More info on the lxcfs homepage: https://linuxcontainers.org/lxcfs/

Answer 2

lxc - kernel namespaces

cgroups - kernel subsystem that monitors the consumption of resources and limits

Inside lxc container system does not know the limits of the cgroup on host os. Linux kernel (on host) will limit the consumption of resources by cgroup.

lxc and cgroup - two independent kernel subsystems. We can use cgroup without lxc and lxc without cgroup.

Openvz - It has a set of kernel patches for correct display of the container limits in the container, but they do not take into vanilla kernel