Add support for setting pids_limit in docker plugin config. #11526
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
shishir-a412ed
force-pushed
the
pids_limit
branch
from
35423c9 to
0bc3d7e
Compare
shishir-a412ed
force-pushed
the
pids_limit
branch
from
0bc3d7e to
51da191
Compare
shishir-a412ed
force-pushed
the
pids_limit
branch
from
51da191 to
d540263
Compare
shishir-a412ed
force-pushed
the
pids_limit
branch
from
139a838 to
2fbbb6f
Compare
shishir-a412ed
force-pushed
the
pids_limit
branch
from
2fbbb6f to
7755d57
Compare
Signed-off-by: Shishir Mahajan <[email protected]>
shishir-a412ed
force-pushed
the
pids_limit
branch
from
7755d57 to
465d220
Compare
lgfa29
approved these changes
Dec 21, 2021
There was a problem hiding this comment.
Thanks @shishir-a412ed this LGTM!
I pushed a few commits to add a CHANGELOG entry and reworded the docs a bit. I also added a new test case to check if the task-level config overrides the plugin config.
|
I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently, Nomad doesn't have a way to enforce
pids_limitin containers, unless set by user in their job spec.If a malicious user launches a container with a fork-bomb, that could exhaust entire nomad client host pids.
This PR will allow the operator to enforce
pids_limitat Nomad client plugin config. User can still override thatpids_limitin their job spec by settingpids_limithowever it must be less than the limit defined on nomad client plugin config.