{"action":"created","comment":{"url":"https://api.github.com/repos/systemd/systemd/pulls/comments/189058163","pull_request_review_id":121163957,"id":189058163,"diff_hunk":"@@ -734,6 +734,31 @@\n         capabilities are passed using the <command>--capabilities=</command>.</para></listitem>\n       </varlistentry>\n \n+      <varlistentry>\n+        <term><option>--rlimit=</option></term>\n+\n+        <listitem><para>Sets the specified POSIX resource limit for the container payload. Expects an assignment of the\n+        form\n+        <literal><replaceable>LIMIT</replaceable>=<replaceable>SOFT</replaceable>:<replaceable>HARD</replaceable></literal>\n+        or <literal><replaceable>LIMIT</replaceable>=<replaceable>VALUE</replaceable></literal>, where\n+        <replaceable>LIMIT</replaceable> should refer to a resource limit type, such as\n+        <constant>RLIMIT_NOFILE</constant> or <constant>RLIMIT_NICE</constant>. The <replaceable>SOFT</replaceable> and\n+        <replaceable>HARD</replaceable> fields should refer to the numeric soft and hard resource limit values. If the\n+        second form is used, <replaceable>VALUE</replaceable> may specifiy a value that is used both as soft and hard\n+        limit. In place of a numeric value the special string <literal>infinity</literal> may be used to turn off\n+        resource limiting for the specific type of resource. This command line option may be used multiple times to\n+        control limits on multiple limit types. If used multiple times for the same limit type, the last last use\n+        wins. For details about resource limits see <citerefentry\n+        project='man-pages'><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>. By default\n+        resource limits for the container's init process (PID 1) are set to the same values the Linux kernel originally\n+        passed to the host init system. Note that some resource limits are enforced on resources counted per user, in","path":"man/systemd-nspawn.xml","position":71,"original_position":21,"commit_id":"10f0b3ce11050decb0e9bc4a479c1ca765547fd9","original_commit_id":"df389c6d64e028bdba187026906192f606f8e3a9","user":{"login":"poettering","id":2130732,"avatar_url":"https://avatars1.githubusercontent.com/u/2130732?v=4","gravatar_id":"","url":"https://api.github.com/users/poettering","html_url":"https://github.com/poettering","followers_url":"https://api.github.com/users/poettering/followers","following_url":"https://api.github.com/users/poettering/following{/other_user}","gists_url":"https://api.github.com/users/poettering/gists{/gist_id}","starred_url":"https://api.github.com/users/poettering/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/poettering/subscriptions","organizations_url":"https://api.github.com/users/poettering/orgs","repos_url":"https://api.github.com/users/poettering/repos","events_url":"https://api.github.com/users/poettering/events{/privacy}","received_events_url":"https://api.github.com/users/poettering/received_events","type":"User","site_admin":false},"body":"i'd really consider containers something seperate from the host, i.e. something that is more like KVM, and hence comes with defaults set up the same way at the kernel would do it on its own.\r\n\r\nNote that this only resets the resource limits, which are generally per-user and per-process resources. Given that containers basically bring their own set of processes and users I think it makes a ton of sense to keep these resource limits specific to each container, and not make them something inherited from the host. \r\n\r\nI think conceptually rlimits are a very different beast from let's say cgroup resource limits, as those actually control resource use in a much more sensible and \"integral\" way, and are inherently something hierarchial. Those of course we should *not* reset, as it makes a ton of sense to apply limits to containers as a whole.\r\n\r\nOr maybe there's a different way to see this: if you play around with DefaultLimitXYZ on the host, or set a resource limit for systemd-nspawn@.service or some instance thereof then this will have an effect on nspawn itself, but not on its payload, and I think that makes a ton of sense. The nspawn supervisor after all is part of the host, while the payload is a completely new environment, which the host should in almost all ways consider a single entity when it comes to resource management and most other forms of management. And given the rlimits are per-user/per-process limits they hence should not leak into this supposedly isolated environment by default.\r\n\r\nAnd yes, this includes that containers might get higher rlimits than the user configured for the host but I think this is OK in the name of isolation","created_at":"2018-05-17T18:30:23Z","updated_at":"2018-05-17T18:30:24Z","html_url":"https://github.com/systemd/systemd/pull/8940#discussion_r189058163","pull_request_url":"https://api.github.com/repos/systemd/systemd/pulls/8940","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/systemd/systemd/pulls/comments/189058163"},"html":{"href":"https://github.com/systemd/systemd/pull/8940#discussion_r189058163"},"pull_request":{"href":"https://api.github.com/repos/systemd/systemd/pulls/8940"}},"in_reply_to_id":188309502},"pull_request":{"url":"https://api.github.com/repos/systemd/systemd/pulls/8940","id":186951212,"html_url":"https://github.com/systemd/systemd/pull/8940","diff_url":"https://github.com/systemd/systemd/pull/8940.diff","patch_url":"https://github.com/systemd/systemd/pull/8940.patch","issue_url":"https://api.github.com/repos/systemd/systemd/issues/8940","number":8940,"state":"open","locked":false,"title":"nspawn: make a couple of additional container parameters configurable","user":{"login":"poettering","id":2130732,"avatar_url":"https://avatars1.githubusercontent.com/u/2130732?v=4","gravatar_id":"","url":"https://api.github.com/users/poettering","html_url":"https://github.com/poettering","followers_url":"https://api.github.com/users/poettering/followers","following_url":"https://api.github.com/users/poettering/following{/other_user}","gists_url":"https://api.github.com/users/poettering/gists{/gist_id}","starred_url":"https://api.github.com/users/poettering/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/poettering/subscriptions","organizations_url":"https://api.github.com/users/poettering/orgs","repos_url":"https://api.github.com/users/poettering/repos","events_url":"https://api.github.com/users/poettering/events{/privacy}","received_events_url":"https://api.github.com/users/poettering/received_events","type":"User","site_admin":false},"body":"This is some initial preparation to make nspawn eventually run OCI containers","created_at":"2018-05-09T15:05:58Z","updated_at":"2018-05-17T18:30:24Z","closed_at":null,"merged_at":null,"merge_commit_sha":"12849d1b5da0267619ea4066b11dd0cbb7e9b96c","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":219550103,"url":"https://api.github.com/repos/systemd/systemd/labels/nspawn","name":"nspawn","color":"bfdadc","default":false},{"id":222775092,"url":"https://api.github.com/repos/systemd/systemd/labels/reviewed/needs-rework%20%F0%9F%94%A8","name":"reviewed/needs-rework 🔨","color":"eb6420","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/systemd/systemd/pulls/8940/commits","review_comments_url":"https://api.github.com/repos/systemd/systemd/pulls/8940/comments","review_comment_url":"https://api.github.com/repos/systemd/systemd/pulls/comments{/number}","comments_url":"https://api.github.com/repos/systemd/systemd/issues/8940/comments","statuses_url":"https://api.github.com/repos/systemd/systemd/statuses/10f0b3ce11050decb0e9bc4a479c1ca765547fd9","head":{"label":"poettering:nspawn-attrs","ref":"nspawn-attrs","sha":"10f0b3ce11050decb0e9bc4a479c1ca765547fd9","user":{"login":"poettering","id":2130732,"avatar_url":"https://avatars1.githubusercontent.com/u/2130732?v=4","gravatar_id":"","url":"https://api.github.com/users/poettering","html_url":"https://github.com/poettering","followers_url":"https://api.github.com/users/poettering/followers","following_url":"https://api.github.com/users/poettering/following{/other_user}","gists_url":"https://api.github.com/users/poettering/gists{/gist_id}","starred_url":"https://api.github.com/users/poettering/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/poettering/subscriptions","organizations_url":"https://api.github.com/users/poettering/orgs","repos_url":"https://api.github.com/users/poettering/repos","events_url":"https://api.github.com/users/poettering/events{/privacy}","received_events_url":"https://api.github.com/users/poettering/received_events","type":"User","site_admin":false},"repo":{"id":37097921,"name":"systemd","full_name":"poettering/systemd","owner":{"login":"poettering","id":2130732,"avatar_url":"https://avatars1.githubusercontent.com/u/2130732?v=4","gravatar_id":"","url":"https://api.github.com/users/poettering","html_url":"https://github.com/poettering","followers_url":"https://api.github.com/users/poettering/followers","following_url":"https://api.github.com/users/poettering/following{/other_user}","gists_url":"https://api.github.com/users/poettering/gists{/gist_id}","starred_url":"https://api.github.com/users/poettering/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/poettering/subscriptions","organizations_url":"https://api.github.com/users/poettering/orgs","repos_url":"https://api.github.com/users/poettering/repos","events_url":"https://api.github.com/users/poettering/events{/privacy}","received_events_url":"https://api.github.com/users/poettering/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/poettering/systemd","description":"systemd upstream","fork":true,"url":"https://api.github.com/repos/poettering/systemd","forks_url":"https://api.github.com/repos/poettering/systemd/forks","keys_url":"https://api.github.com/repos/poettering/systemd/keys{/key_id}","collaborators_url":"https://api.github.com/repos/poettering/systemd/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/poettering/systemd/teams","hooks_url":"https://api.github.com/repos/poettering/systemd/hooks","issue_events_url":"https://api.github.com/repos/poettering/systemd/issues/events{/number}","events_url":"https://api.github.com/repos/poettering/systemd/events","assignees_url":"https://api.github.com/repos/poettering/systemd/assignees{/user}","branches_url":"https://api.github.com/repos/poettering/systemd/branches{/branch}","tags_url":"https://api.github.com/repos/poettering/systemd/tags","blobs_url":"https://api.github.com/repos/poettering/systemd/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/poettering/systemd/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/poettering/systemd/git/refs{/sha}","trees_url":"https://api.github.com/repos/poettering/systemd/git/trees{/sha}","statuses_url":"https://api.github.com/repos/poettering/systemd/statuses/{sha}","languages_url":"https://api.github.com/repos/poettering/systemd/languages","stargazers_url":"https://api.github.com/repos/poettering/systemd/stargazers","contributors_url":"https://api.github.com/repos/poettering/systemd/contributors","subscribers_url":"https://api.github.com/repos/poettering/systemd/subscribers","subscription_url":"https://api.github.com/repos/poettering/systemd/subscription","commits_url":"https://api.github.com/repos/poettering/systemd/commits{/sha}","git_commits_url":"https://api.github.com/repos/poettering/systemd/git/commits{/sha}","comments_url":"https://api.github.com/repos/poettering/systemd/comments{/number}","issue_comment_url":"https://api.github.com/repos/poettering/systemd/issues/comments{/number}","contents_url":"https://api.github.com/repos/poettering/systemd/contents/{+path}","compare_url":"https://api.github.com/repos/poettering/systemd/compare/{base}...{head}","merges_url":"https://api.github.com/repos/poettering/systemd/merges","archive_url":"https://api.github.com/repos/poettering/systemd/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/poettering/systemd/downloads","issues_url":"https://api.github.com/repos/poettering/systemd/issues{/number}","pulls_url":"https://api.github.com/repos/poettering/systemd/pulls{/number}","milestones_url":"https://api.github.com/repos/poettering/systemd/milestones{/number}","notifications_url":"https://api.github.com/repos/poettering/systemd/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/poettering/systemd/labels{/name}","releases_url":"https://api.github.com/repos/poettering/systemd/releases{/id}","deployments_url":"https://api.github.com/repos/poettering/systemd/deployments","created_at":"2015-06-08T23:07:59Z","updated_at":"2018-04-25T10:39:07Z","pushed_at":"2018-05-17T17:54:45Z","git_url":"git://github.com/poettering/systemd.git","ssh_url":"git@github.com:poettering/systemd.git","clone_url":"https://github.com/poettering/systemd.git","svn_url":"https://github.com/poettering/systemd","homepage":"http://www.freedesktop.org/wiki/Software/systemd/","size":89530,"stargazers_count":12,"watchers_count":12,"language":"C","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":2,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"gpl-2.0","name":"GNU General Public License v2.0","spdx_id":"GPL-2.0","url":"https://api.github.com/licenses/gpl-2.0"},"forks":2,"open_issues":0,"watchers":12,"default_branch":"master"}},"base":{"label":"systemd:master","ref":"master","sha":"32e2e0ade9e1caef750b6be948c32b183800222a","user":{"login":"systemd","id":1918868,"avatar_url":"https://avatars0.githubusercontent.com/u/1918868?v=4","gravatar_id":"","url":"https://api.github.com/users/systemd","html_url":"https://github.com/systemd","followers_url":"https://api.github.com/users/systemd/followers","following_url":"https://api.github.com/users/systemd/following{/other_user}","gists_url":"https://api.github.com/users/systemd/gists{/gist_id}","starred_url":"https://api.github.com/users/systemd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/systemd/subscriptions","organizations_url":"https://api.github.com/users/systemd/orgs","repos_url":"https://api.github.com/users/systemd/repos","events_url":"https://api.github.com/users/systemd/events{/privacy}","received_events_url":"https://api.github.com/users/systemd/received_events","type":"Organization","site_admin":false},"repo":{"id":32873313,"name":"systemd","full_name":"systemd/systemd","owner":{"login":"systemd","id":1918868,"avatar_url":"https://avatars0.githubusercontent.com/u/1918868?v=4","gravatar_id":"","url":"https://api.github.com/users/systemd","html_url":"https://github.com/systemd","followers_url":"https://api.github.com/users/systemd/followers","following_url":"https://api.github.com/users/systemd/following{/other_user}","gists_url":"https://api.github.com/users/systemd/gists{/gist_id}","starred_url":"https://api.github.com/users/systemd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/systemd/subscriptions","organizations_url":"https://api.github.com/users/systemd/orgs","repos_url":"https://api.github.com/users/systemd/repos","events_url":"https://api.github.com/users/systemd/events{/privacy}","received_events_url":"https://api.github.com/users/systemd/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/systemd/systemd","description":"⚙️ 🐧 systemd System and Service Manager ","fork":false,"url":"https://api.github.com/repos/systemd/systemd","forks_url":"https://api.github.com/repos/systemd/systemd/forks","keys_url":"https://api.github.com/repos/systemd/systemd/keys{/key_id}","collaborators_url":"https://api.github.com/repos/systemd/systemd/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/systemd/systemd/teams","hooks_url":"https://api.github.com/repos/systemd/systemd/hooks","issue_events_url":"https://api.github.com/repos/systemd/systemd/issues/events{/number}","events_url":"https://api.github.com/repos/systemd/systemd/events","assignees_url":"https://api.github.com/repos/systemd/systemd/assignees{/user}","branches_url":"https://api.github.com/repos/systemd/systemd/branches{/branch}","tags_url":"https://api.github.com/repos/systemd/systemd/tags","blobs_url":"https://api.github.com/repos/systemd/systemd/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/systemd/systemd/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/systemd/systemd/git/refs{/sha}","trees_url":"https://api.github.com/repos/systemd/systemd/git/trees{/sha}","statuses_url":"https://api.github.com/repos/systemd/systemd/statuses/{sha}","languages_url":"https://api.github.com/repos/systemd/systemd/languages","stargazers_url":"https://api.github.com/repos/systemd/systemd/stargazers","contributors_url":"https://api.github.com/repos/systemd/systemd/contributors","subscribers_url":"https://api.github.com/repos/systemd/systemd/subscribers","subscription_url":"https://api.github.com/repos/systemd/systemd/subscription","commits_url":"https://api.github.com/repos/systemd/systemd/commits{/sha}","git_commits_url":"https://api.github.com/repos/systemd/systemd/git/commits{/sha}","comments_url":"https://api.github.com/repos/systemd/systemd/comments{/number}","issue_comment_url":"https://api.github.com/repos/systemd/systemd/issues/comments{/number}","contents_url":"https://api.github.com/repos/systemd/systemd/contents/{+path}","compare_url":"https://api.github.com/repos/systemd/systemd/compare/{base}...{head}","merges_url":"https://api.github.com/repos/systemd/systemd/merges","archive_url":"https://api.github.com/repos/systemd/systemd/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/systemd/systemd/downloads","issues_url":"https://api.github.com/repos/systemd/systemd/issues{/number}","pulls_url":"https://api.github.com/repos/systemd/systemd/pulls{/number}","milestones_url":"https://api.github.com/repos/systemd/systemd/milestones{/number}","notifications_url":"https://api.github.com/repos/systemd/systemd/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/systemd/systemd/labels{/name}","releases_url":"https://api.github.com/repos/systemd/systemd/releases{/id}","deployments_url":"https://api.github.com/repos/systemd/systemd/deployments","created_at":"2015-03-25T15:27:27Z","updated_at":"2018-05-17T17:45:39Z","pushed_at":"2018-05-17T18:17:58Z","git_url":"git://github.com/systemd/systemd.git","ssh_url":"git@github.com:systemd/systemd.git","clone_url":"https://github.com/systemd/systemd.git","svn_url":"https://github.com/systemd/systemd","homepage":"https://www.freedesktop.org/wiki/Software/systemd/","size":89594,"stargazers_count":3148,"watchers_count":3148,"language":"C","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1232,"mirror_url":null,"archived":false,"open_issues_count":932,"license":{"key":"gpl-2.0","name":"GNU General Public License v2.0","spdx_id":"GPL-2.0","url":"https://api.github.com/licenses/gpl-2.0"},"forks":1232,"open_issues":932,"watchers":3148,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/systemd/systemd/pulls/8940"},"html":{"href":"https://github.com/systemd/systemd/pull/8940"},"issue":{"href":"https://api.github.com/repos/systemd/systemd/issues/8940"},"comments":{"href":"https://api.github.com/repos/systemd/systemd/issues/8940/comments"},"review_comments":{"href":"https://api.github.com/repos/systemd/systemd/pulls/8940/comments"},"review_comment":{"href":"https://api.github.com/repos/systemd/systemd/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/systemd/systemd/pulls/8940/commits"},"statuses":{"href":"https://api.github.com/repos/systemd/systemd/statuses/10f0b3ce11050decb0e9bc4a479c1ca765547fd9"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"poettering"}}