ES 2.0.0: Cannot mlockall even when privileged or with --cap-add=IPC_LOCK

[jimmidyson]

With Docker 1.9.0 & elasticsearch:2.0.0:

$ docker run --rm --privileged elasticsearch:2.0.0 -Des.bootstrap.mlockall=true
[2015-11-20 09:06:08,908][WARN ][bootstrap                ] Unable to lock JVM Memory: error=12,reason=Cannot allocate memory
[2015-11-20 09:06:08,908][WARN ][bootstrap                ] This can result in part of the JVM being swapped out.
[2015-11-20 09:06:08,908][WARN ][bootstrap                ] Increase RLIMIT_MEMLOCK, soft limit: 65536, hard limit: 65536
[2015-11-20 09:06:08,908][WARN ][bootstrap                ] These can be adjusted by modifying /etc/security/limits.conf, for example: 
        # allow user 'elasticsearch' mlockall
        elasticsearch soft memlock unlimited
        elasticsearch hard memlock unlimited

I assume this is still recommended & supposed to work?

[jimmidyson]

Closing - for anyone else that comes across this the following works (& doesn't require privileged either):

docker run --rm --cap-add=IPC_LOCK --ulimit memlock=-1:-1 elasticsearch:2.0.0 -Des.bootstrap.mlockall=true

[nikolai-derzhak-distillery]

@jimmidyson Thanks man !

[orweinberger]

@jimmidyson Been looking for this, thank you.

[aalexgabi]

Edit: It seems that Elasticsearch configuration must be mounted in /usr/share/elasticsearch/config and not /etc/elasticsearch. The presence of /etc/elasticsearch is confusing. Why the Docker image doesn't use the standard /etc/elasticsearch path?

Original post:

After at least 6 hours of struggling to get it working this helped me solve it. 
`bootstrap.mlockall: true` option was present in my configuration but it seems it's not enough. Once I added `-Des.bootstrap.mlockall=true` to the run command it worked (i already had `--cap-add=IPC_LOCK --ulimit memlock=-1:-1`).

This should be documented somewhere. Maybe even https://www.elastic.co/guide/en/elasticsearch/reference/1.7/setup-configuration.html should mention it.

@jimmidyson Why setting `bootstrap.mlockall=true` in the configuration is not enough?

Using [email protected]