Memory limit for a rootless container on cgroups v1?

[yaqwsx]

Hello, I am struggling with Podman and I am not sure if it is a bug or I just read the documentation wrong.

I would like to run a rootless container with a memory limit on a system with cgroups v1; i.e. something like this:

h$ podman run -it --memory 200MB ubuntu:20.04
p$: cat /sys/fs/cgroup/memory/memory.limit_in_bytes # This should give 209715200
9223372036854771712
p$ stress -m 5 --vm-bytes 1G --vm-keep --timeout 20s # This should be killed but isn't
p$

Podman does not show any errors. When I run the same example with cgroups v2, it works. Is the memory limit supposed to work on cgroups v1? If not, why doesn't Podman fail with an error message? I did not find anything about memory limitation not working on cgroups v1 in the documentation.

[mheon]

Memory limits as a non-root user only work with cgroups v2. I'm actually surprised the container is starting, and not throwing an error because of the unsupported flag.

[yaqwsx]

Thanks for the fast answer. That's why I am asking - if it is not supported, I would expect it to return an error.

[rhatdan]

It depends on whether or not the OCI Runtime reports an error or just ignores it. Podman has no knowledge of cgroups V1 versus V2. That is only in the underlying libraries and tools that it uses.

[mheon]

I think this is a bug - we have a massive block of code that checks if resource limits are supported and throws warnings (not hard errors, notably) when an unsupported limit is requested. It would not be hard to extent this to also check if cgroups v1 is in use and we're rootless.