You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: config-linux.md
+22-14Lines changed: 22 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -164,14 +164,14 @@ In addition to any devices configured with this setting, the runtime MUST also s
164
164
165
165
Also known as cgroups, they are used to restrict resource usage for a container and handle device access.
166
166
cgroups provide controls to restrict cpu, memory, IO, pids and network for the container.
167
-
For more information, see the [kernel cgroups documentation](https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt).
167
+
For more information, see the [kernel cgroups documentation][cgroup-v1].
168
168
169
169
The path to the cgroups can be specified in the Spec via `cgroupsPath`.
170
170
`cgroupsPath` is expected to be relative to the cgroups mount point.
171
171
If `cgroupsPath` is not specified, implementations can define the default cgroup path.
172
172
Implementations of the Spec can choose to name cgroups in any manner.
173
173
The Spec does not include naming schema for cgroups.
174
-
The Spec does not support [split hierarchy](https://www.kernel.org/doc/Documentation/cgroups/unified-hierarchy.txt).
174
+
The Spec does not support [split hierarchy][cgroup-v2].
175
175
The cgroups will be created if they don't exist.
176
176
177
177
###### Example
@@ -188,7 +188,7 @@ For example, to run a new process in an existing container without updating limi
188
188
189
189
#### Device whitelist
190
190
191
-
`devices` is an array of entries to control the [device whitelist][cgroups-devices].
191
+
`devices` is an array of entries to control the [device whitelist][cgroup-v1-devices].
192
192
The runtime MUST apply entries in the listed order.
193
193
194
194
The following parameters can be specified:
@@ -197,7 +197,7 @@ The following parameters can be specified:
197
197
***`type`***(char, optional)* - type of device: `a` (all), `c` (char), or `b` (block).
198
198
`null` or unset values mean "all", mapping to `a`.
199
199
***`major, minor`***(int64, optional)* - [major, minor numbers][devices] for the device.
200
-
`null` or unset values mean "all", mapping to [`*` in the filesystem API][cgroups-devices].
200
+
`null` or unset values mean "all", mapping to [`*` in the filesystem API][cgroup-v1-devices].
201
201
***`access`***(string, required)* - cgroup permissions for device.
202
202
A composition of `r` (read), `w` (write), and `m` (mknod).
203
203
@@ -232,7 +232,7 @@ The following parameters can be specified:
232
232
If enabled (`false`), tasks that attempt to consume more memory than they are allowed are immediately killed by the OOM killer.
233
233
The OOM killer is enabled by default in every cgroup using the `memory` subsystem.
234
234
To disable it, specify a value of `true`.
235
-
For more information, see [the memory cgroup man page](https://www.kernel.org/doc/Documentation/cgroups/memory.txt).
235
+
For more information, see [the memory cgroup man page][cgroup-v1-memory].
236
236
237
237
***`disableOOMKiller`***(bool, optional)* - enables or disables the OOM killer
238
238
@@ -247,7 +247,7 @@ For more information, see [the memory cgroup man page](https://www.kernel.org/do
247
247
`oomScoreAdj` sets heuristic regarding how the process is evaluated by the kernel during memory pressure.
248
248
For more information, see [the proc filesystem documentation section 3.1](https://www.kernel.org/doc/Documentation/filesystems/proc.txt).
249
249
This is a kernel/system level setting, where as `disableOOMKiller` is scoped for a memory cgroup.
250
-
For more information on how these two settings work together, see [the memory cgroup documentation section 10. OOM Contol](https://www.kernel.org/doc/Documentation/cgroups/memory.txt).
250
+
For more information on how these two settings work together, see [the memory cgroup documentation section 10. OOM Contol][cgroup-v1-memory].
251
251
252
252
***`oomScoreAdj`***(int, optional)* - adjust the oom-killer score
253
253
@@ -260,7 +260,7 @@ For more information on how these two settings work together, see [the memory cg
260
260
#### Memory
261
261
262
262
`memory` represents the cgroup subsystem `memory` and it's used to set limits on the container's memory usage.
263
-
For more information, see [the memory cgroup man page](https://www.kernel.org/doc/Documentation/cgroups/memory.txt).
263
+
For more information, see [the memory cgroup man page][cgroup-v1-memory].
264
264
265
265
The following parameters can be specified to setup the controller:
266
266
@@ -292,7 +292,7 @@ The following parameters can be specified to setup the controller:
292
292
#### CPU
293
293
294
294
`cpu` represents the cgroup subsystems `cpu` and `cpusets`.
295
-
For more information, see [the cpusets cgroup man page](https://www.kernel.org/doc/Documentation/cgroups/cpusets.txt).
295
+
For more information, see [the cpusets cgroup man page][cgroup-v1-cpusets].
296
296
297
297
The following parameters can be specified to setup the controller:
298
298
@@ -327,7 +327,7 @@ The following parameters can be specified to setup the controller:
327
327
#### Block IO Controller
328
328
329
329
`blockIO` represents the cgroup subsystem `blkio` which implements the block io controller.
330
-
For more information, see [the kernel cgroups documentation about blkio](https://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt).
330
+
For more information, see [the kernel cgroups documentation about blkio][cgroup-v1-blkio].
331
331
332
332
The following parameters can be specified to setup the controller:
333
333
@@ -386,7 +386,7 @@ The following parameters can be specified to setup the controller:
386
386
387
387
`hugepageLimits` represents the `hugetlb` controller which allows to limit the
388
388
HugeTLB usage per control group and enforces the controller limit during page fault.
389
-
For more information, see the [kernel cgroups documentation about HugeTLB](https://www.kernel.org/doc/Documentation/cgroups/hugetlb.txt).
389
+
For more information, see the [kernel cgroups documentation about HugeTLB][cgroup-v1-hugetlb].
390
390
391
391
`hugepageLimits` is an array of entries, each having the following structure:
392
392
@@ -408,7 +408,7 @@ For more information, see the [kernel cgroups documentation about HugeTLB](https
408
408
#### Network
409
409
410
410
`network` represents the cgroup subsystems `net_cls` and `net_prio`.
411
-
For more information, see [the net\_cls cgroup man page](https://www.kernel.org/doc/Documentation/cgroups/net_cls.txt) and [the net\_prio cgroup man page](https://www.kernel.org/doc/Documentation/cgroups/net_prio.txt).
411
+
For more information, see [the net\_cls cgroup man page][cgroup-v1-net-cls] and [the net\_prio cgroup man page][cgroup-v1-net-prio].
412
412
413
413
The following parameters can be specified to setup these cgroup controllers:
414
414
@@ -440,8 +440,7 @@ processes in the group and egressing the system on various interfaces. The follo
440
440
#### PIDs
441
441
442
442
`pids` represents the cgroup subsystem `pids`.
443
-
For more information, see [the pids cgroup man page](https://www.kernel.org/doc/Documentation/cgroups/pids.txt
444
-
).
443
+
For more information, see [the pids cgroup man page][cgroup-v1-pids].
445
444
446
445
The following paramters can be specified to setup the controller:
447
446
@@ -586,7 +585,16 @@ Setting `noNewPrivileges` to true prevents the processes in the container from g
0 commit comments