{"action":"created","issue":{"url":"https://api.github.com/repos/rancher/os/issues/722","labels_url":"https://api.github.com/repos/rancher/os/issues/722/labels{/name}","comments_url":"https://api.github.com/repos/rancher/os/issues/722/comments","events_url":"https://api.github.com/repos/rancher/os/issues/722/events","html_url":"https://github.com/rancher/os/issues/722","id":124994998,"number":722,"title":"'max user processes' for non root users","user":{"login":"Rucknar","id":5539660,"avatar_url":"https://avatars.githubusercontent.com/u/5539660?v=3","gravatar_id":"","url":"https://api.github.com/users/Rucknar","html_url":"https://github.com/Rucknar","followers_url":"https://api.github.com/users/Rucknar/followers","following_url":"https://api.github.com/users/Rucknar/following{/other_user}","gists_url":"https://api.github.com/users/Rucknar/gists{/gist_id}","starred_url":"https://api.github.com/users/Rucknar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Rucknar/subscriptions","organizations_url":"https://api.github.com/users/Rucknar/orgs","repos_url":"https://api.github.com/users/Rucknar/repos","events_url":"https://api.github.com/users/Rucknar/events{/privacy}","received_events_url":"https://api.github.com/users/Rucknar/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-01-05T16:00:25Z","updated_at":"2016-01-06T17:39:12Z","closed_at":null,"body":"I'll start off by admitting i don't quite 'get' the way this hangs together.\r\n\r\n**Background**\r\nWe have a number of images running tomcat under a non-root user. I've scaled the number of containers today and i noticed straight away that i couldn't run the command `su - bob` as it returns a `su: /bin/bash: Resource temporarily unavailable` \r\n```\r\nComponent\tVersion\r\nRancher\tv0.50.1\r\nCattle\tv0.127.0\r\nUser Interface\tv0.74.0\r\nRancher Compose\tv0.6.2\r\n```\r\n\r\n**Summary**\r\nI believe we are hitting the 'max user processes' value as reported by the ulimit command.\r\nif i run the ulimit command as root on the rancherOS host then i see that this value has been set really high to `1031572`. When i run processes as the non-root user however, they pick up all the other values of the root user but this one value has defaulted back to `1024`. \r\n\r\n**Issue**\r\nHow do i properly configure this with RancherOS? i guess without proper namespacing yet in a stable docker build, this non-root user shares it's limits across all running containers? If so, without something like limits.conf, how do i set this value consistently? \r\n\r\nUlimit for root user on the host:\r\n```\r\ncore file size          (blocks, -c) 0\r\ndata seg size           (kbytes, -d) unlimited\r\nscheduling priority             (-e) 0\r\nfile size               (blocks, -f) unlimited\r\npending signals                 (-i) 1031572\r\nmax locked memory       (kbytes, -l) 64\r\nmax memory size         (kbytes, -m) unlimited\r\nopen files                      (-n) 1000000\r\npipe size            (512 bytes, -p) 8\r\nPOSIX message queues     (bytes, -q) 819200\r\nreal-time priority              (-r) 0\r\nstack size              (kbytes, -s) 8192\r\ncpu time               (seconds, -t) unlimited\r\nmax user processes              (-u) 1031572\r\nvirtual memory          (kbytes, -v) unlimited\r\nfile locks                      (-x) unlimited\r\n```\r\n\r\nUlimit for root user in the container\r\n```\r\ncore file size          (blocks, -c) 0                                          \r\ndata seg size           (kbytes, -d) unlimited                                  \r\nscheduling priority             (-e) 0                                          \r\nfile size               (blocks, -f) unlimited                                  \r\npending signals                 (-i) 1031572                                    \r\nmax locked memory       (kbytes, -l) 64                                         \r\nmax memory size         (kbytes, -m) unlimited                                  \r\nopen files                      (-n) 1000000                                    \r\npipe size            (512 bytes, -p) 8                                          \r\nPOSIX message queues     (bytes, -q) 819200                                     \r\nreal-time priority              (-r) 0                                          \r\nstack size              (kbytes, -s) 8192                                       \r\ncpu time               (seconds, -t) unlimited                                  \r\nmax user processes              (-u) 1031572                                    \r\nvirtual memory          (kbytes, -v) unlimited                                  \r\nfile locks                      (-x) unlimited \r\n```\r\n\r\nUlimit for the non-root user inside the container\r\n```\r\ncore file size          (blocks, -c) 0                                          \r\ndata seg size           (kbytes, -d) unlimited                                  \r\nscheduling priority             (-e) 0                                          \r\nfile size               (blocks, -f) unlimited                                  \r\npending signals                 (-i) 1031572                                    \r\nmax locked memory       (kbytes, -l) 64                                         \r\nmax memory size         (kbytes, -m) unlimited                                  \r\nopen files                      (-n) 1000000                                    \r\npipe size            (512 bytes, -p) 8                                          \r\nPOSIX message queues     (bytes, -q) 819200                                     \r\nreal-time priority              (-r) 0                                          \r\nstack size              (kbytes, -s) 8192                                       \r\ncpu time               (seconds, -t) unlimited                                  \r\nmax user processes              (-u) 1024                                      \r\nvirtual memory          (kbytes, -v) unlimited                                  \r\nfile locks                      (-x) unlimited \r\n```"},"comment":{"url":"https://api.github.com/repos/rancher/os/issues/comments/169399558","html_url":"https://github.com/rancher/os/issues/722#issuecomment-169399558","issue_url":"https://api.github.com/repos/rancher/os/issues/722","id":169399558,"user":{"login":"deniseschannon","id":11410997,"avatar_url":"https://avatars.githubusercontent.com/u/11410997?v=3","gravatar_id":"","url":"https://api.github.com/users/deniseschannon","html_url":"https://github.com/deniseschannon","followers_url":"https://api.github.com/users/deniseschannon/followers","following_url":"https://api.github.com/users/deniseschannon/following{/other_user}","gists_url":"https://api.github.com/users/deniseschannon/gists{/gist_id}","starred_url":"https://api.github.com/users/deniseschannon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deniseschannon/subscriptions","organizations_url":"https://api.github.com/users/deniseschannon/orgs","repos_url":"https://api.github.com/users/deniseschannon/repos","events_url":"https://api.github.com/users/deniseschannon/events{/privacy}","received_events_url":"https://api.github.com/users/deniseschannon/received_events","type":"User","site_admin":false},"created_at":"2016-01-06T17:39:11Z","updated_at":"2016-01-06T17:39:11Z","body":"Honestly, I don't know how to restart system-docker except with a system reboot. But if you want to try setting it through the command, it'd need to be `sudo ros config set rancher.system_docker.extra_args [--ulimit nproc=-1]`. But as I write it, I'm not sure if it'll work as there is there is an issue setting lists in v0.4.2.  https://github.com/rancher/os/issues/716"}}