Add support for kmem.tcp limit

README.md

@@ -243,6 +243,7 @@ user with uid and gid of `0` defined within that file-system.
 				"reservation": 0,
 				"swap": 0,
 				"kernel": 0,
+				"kernelTCP": 0,
 				"swappiness": -1
 			},
 			"cpu": {

libcontainer/cgroups/fs/memory.go

@@ -73,6 +73,11 @@ func (s *MemoryGroup) Set(path string, cgroup *configs.Cgroup) error {
 			return err
 		}
 	}
+	if cgroup.KernelMemoryTCP > 0 {
+		if err := writeFile(path, "memory.kmem.tcp.limit_in_bytes", strconv.FormatInt(cgroup.KernelMemoryTCP, 10)); err != nil {
+			return err
+		}
+	}
 
 	if cgroup.OomKillDisable {
 		if err := writeFile(path, "memory.oom_control", "1"); err != nil {

libcontainer/cgroups/fs/memory_test.go

@@ -113,6 +113,34 @@ func TestMemorySetKernelMemory(t *testing.T) {
 	}
 }
 
+func TestMemorySetKernelMemory(t *testing.T) {
+	helper := NewCgroupTestUtil("memory", t)
+	defer helper.cleanup()
+
+	const (
+		kernelMemoryTCPBefore = 314572800 // 300M
+		kernelMemoryTCPAfter  = 524288000 // 500M
+	)
+
+	helper.writeFileContents(map[string]string{
+		"memory.kmem.tcp.limit_in_bytes": strconv.Itoa(kernelMemoryTCPBefore),
+	})
+
+	helper.CgroupData.c.KernelMemoryTCP = kernelMemoryTCPAfter
+	memory := &MemoryGroup{}
+	if err := memory.Set(helper.CgroupPath, helper.CgroupData.c); err != nil {
+		t.Fatal(err)
+	}
+
+	value, err := getCgroupParamUint(helper.CgroupPath, "memory.kmem.tcp.limit_in_bytes")
+	if err != nil {
+		t.Fatalf("Failed to parse memory.kmem.tcp.limit_in_bytes - %s", err)
+	}
+	if value != kernelMemoryTCPAfter {
+		t.Fatal("Got the wrong value, set memory.kmem.tcp.limit_in_bytes failed.")
+	}
+}
+
 func TestMemorySetMemorySwappinessDefault(t *testing.T) {
 	helper := NewCgroupTestUtil("memory", t)
 	defer helper.cleanup()

libcontainer/cgroups/systemd/apply_systemd.go

@@ -539,6 +539,12 @@ func joinMemory(c *configs.Cgroup, pid int) error {
 			return err
 		}
 	}
+	if c.KernelMemoryTCP > 0 {
+		err = writeFile(path, "memory.kmem.tcp.limit_in_bytes", strconv.FormatInt(c.KernelMemoryTCP, 10))
+		if err != nil {
+			return err
+		}
+	}
 	if c.OomKillDisable {
 		if err := writeFile(path, "memory.oom_control", "1"); err != nil {
 			return err

libcontainer/configs/cgroup_unix.go

@@ -35,6 +35,9 @@ type Cgroup struct {
 	// Kernel memory limit (in bytes)
 	KernelMemory int64 `json:"kernel_memory"`
 
+	// Kernel memory limit for TCP using (in bytes)
+	KernelMemoryTCP int64 `json:"kernel_memory_tcp"`
+
 	// CPU shares (relative weight vs. other containers)
 	CpuShares int64 `json:"cpu_shares"`
 

spec.go

@@ -448,6 +448,7 @@ func createCgroupConfig(name string, spec *specs.LinuxRuntimeSpec, devices []*co
 	c.MemoryReservation = r.Memory.Reservation
 	c.MemorySwap = r.Memory.Swap
 	c.KernelMemory = r.Memory.Kernel
+	c.KernelMemoryTCP = r.Memory.KernelTCP
 	c.MemorySwappiness = r.Memory.Swappiness
 	c.CpuShares = r.CPU.Shares
 	c.CpuQuota = r.CPU.Quota