Dear Maintainer,

if you wawnt to limit the memory of an LXC Contianer via libvirt.
the limit gets not enforced.

the container cann see and allocate the full Host memory.



# Steps to reproduce.

# Install Debian Stretch minimal

# Install basic libvirt with kvm and lxc support
apt install qemu-kvm libvirt-clients libvirt-daemon-system virtinst libosinfo-bin debootstrap lxcfs


# create root fs for the container

mkdir -p /var/lxc/
cd /var/lxc/
debootstrap --arch=amd64 stretch ct1

# define the container in virsh wich has lower memory than your host
cd ~

echo "<domain type='lxc'>
  <name>ct1</name>
  <uuid>b1981e50-3bbc-40bf-b145-4a50e927eb7d</uuid>
  <memory unit='KiB'>4000000</memory>
  <currentMemory unit='KiB'>4000000</currentMemory>
  <memtune>
    <swap_hard_limit unit='KiB'>4000000</swap_hard_limit>
  </memtune>
  <vcpu placement='static' cpuset='0-1'>2</vcpu>
  <resource>
    <partition>/machine</partition>
  </resource>
  <os>
    <type arch='x86_64'>exe</type>
    <init>/sbin/init</init>
  </os>
  <clock offset='utc'/>
  <on_poweroff>destroy</on_poweroff>
  <on_reboot>restart</on_reboot>
  <on_crash>destroy</on_crash>
  <devices>
    <emulator>/usr/lib/libvirt/libvirt_lxc</emulator>
    <filesystem type='mount' accessmode='passthrough'>
      <source dir='/var/lxc/ct1'/>
      <target dir='/'/>
    </filesystem>
    <filesystem type='mount' accessmode='passthrough'>
      <source dir='/var/lib/lxcfs/proc/cpuinfo'/>
      <target dir='/proc/cpuinfo'/>
    </filesystem>
    <filesystem type='mount' accessmode='passthrough'>
      <source dir='/var/lib/lxcfs/proc/diskstats'/>
      <target dir='/proc/diskstats'/>
    </filesystem>
    <filesystem type='mount' accessmode='passthrough'>
      <source dir='/var/lib/lxcfs/proc/meminfo'/>
      <target dir='/proc/meminfo'/>
    </filesystem>
    <filesystem type='mount' accessmode='passthrough'>
      <source dir='/var/lib/lxcfs/proc/stat'/>
      <target dir='/proc/stat'/>
    </filesystem>
    <filesystem type='mount' accessmode='passthrough'>
      <source dir='/var/lib/lxcfs/proc/swaps'/>
      <target dir='/proc/swaps'/>
    </filesystem>
    <filesystem type='mount' accessmode='passthrough'>
      <source dir='/var/lib/lxcfs/proc/uptime'/>
      <target dir='/proc/uptime'/>
    </filesystem>
    <interface type='bridge'>
      <mac address='52:54:00:34:28:f3'/>
      <source bridge='br0'/>
      <guest dev='eth0'/>
    </interface>
    <console type='pty'>
      <target type='lxc' port='0'/>
    </console>
  </devices>
  <seclabel type='none' model='none'/>
</domain>" > ct1.xml

virsh -c lxc:// define ct1.xml

# start up
virsh -c lxc:// start ct1

# go in
virsh -c lxc:// console ct1

# check the memory
free -m < more than defined in the xml



so far i see the processes (all whats comes after init) that the container spawens are leaving/bypassing the cgroup/namespace
but i havent found something how to prevent this. So i think its a bug.

Hi,
	To control memory with libvirt-lxc you need to have the memory controller and
	swap account controllers active.  This means (on Debian)
	adding:
	     cgroup_enable=memory swapaccount=1
	to GRUB_CMDLINE_LINUX_DEFAULT in  /etc/default/grub
	doing
		sudo update-grub
	and then rebooting.

	You are probably seeing lots of messages in your logs like:
   Failed to open file '/sys/fs/cgroup/memory/machine/lxc-41320-containername.libvirt-lxc/memory.memsw.usage_in_bytes
        in your logs.

Peter C

Hi Peter,

thank you for the reply but that dosent work for me.
have you reproduce it with the steps above?

shows still to much memory and can use to much

tested with stress inside the container
stress --vm-bytes $(awk '/MemFree/{printf "%d\n", $2 * 0.9;}' <
/proc/meminfo)k --vm-keep -m 1

i think something is broken in the cgroups association and the processes
because there are some pids missing

cat /sys/fs/cgroup/memory/machine/lxc-1674-ct1.libvirt-lxc/cgroup.procs
1674

ps auxf
root      1674  0.0  0.3 210720  7200 ?        Sl   14:34   0:00
/usr/lib/libvirt/libvirt_lxc --name ct1 --console 22 --security=none
--handshake 25 --veth vnet1
root      1676  0.0  0.2  56724  5236 ?        Ss   14:34   0:00  \_
/sbin/init
root      1695  0.0  0.1  46092  2248 ?        Ss   14:34   0:00      \_
/lib/systemd/systemd-journald
root      1727  0.0  0.0  27992  1064 ?        Ss   14:34   0:00      \_
/usr/sbin/cron -f
root      1728  0.0  0.0 254332  1892 ?        Ssl  14:34   0:00      \_
/usr/sbin/rsyslogd -n
root      2299  0.0  0.0  12668  1728 pts/0    Ss+  14:56   0:00      \_
/sbin/agetty --noclear --keep-baud console 115200,38400,9600 linux

Dear Maintainer,

Markus is quite right regarding this bug and it is documented at
https://discuss.linuxcontainers.org/t/memory-limits-no-longer-being-applied/7429

However, I recently upgraded to Debian 11 and the bug is no
longer present.

Hope that helps you Markus!

Alexis