<p>As I know if we need adjust "open files" <code>nofile</code> (soft and hard) in linux system, we need run command <code>ulimit</code> or set in related configuraiton file to get the setting permanently. But I am little bit confused about the setting for containers running in a host</p>

<p>For example, If a Linux OS has <code>ulimit</code> nofile set to 1024 (soft) and Hard (4096) , and I run docker with <code>--ulimit nofile=10240:40960</code>, could the container use more nofiles than its host?</p>

<h1>Update</h1>

<p>In my environment, current setting with dockers running, </p>

<ul>
<li>On host (Debian)-  65535 (soft) 65535 (hard) </li>
<li>Docker Daemon setting Max - 1048576 (soft) 1048576 (hard) </li>
<li>default docker run - 1024 (soft) 4096 (hard) </li>
<li>customized docker run - 10240 (soft) 40960 (hard)</li>
</ul>

<p>I found the application can run with about 100K open files, then crash. How to understand this?</p>

<p>What's the real limits?</p>

<blockquote>
  <p>For example, If a Linux OS has <code>ulimit</code> nofile set to 1024 (soft) and Hard (4096) , and I run docker with <code>----ulimit nofile=10240:40960</code>, could the container use more nofiles than its host?</p>
</blockquote>

<ul>
<li>Docker has the <code>CAP_SYS_RESOURCE</code> capability set on it's permissions.
This means that Docker is able to set an <code>ulimit</code> different from the host. according to <code>man 2 prlimit</code>:</li>
</ul>

<blockquote>
  <p>A privileged process (under Linux: one with the CAP_SYS_RESOURCE capability in the initial user namespace) may make arbitrary changes to either limit value.</p>
</blockquote>

<ul>
<li>So, for containers, the limits to be considered are the ones set by the docker daemon.
You can check the docker daemon limits with this command:</li>
</ul>

<pre><code>$ cat /proc/$(ps -A | grep dockerd | awk '{print $1}')/limits | grep "files"
Max open files            1048576              1048576              files 
</code></pre>

<ul>
<li><p>As you can see, the docker 19 has a pretty high limit of <code>1048576</code> so your 40960 <strong>will work</strong> like a charm.</p></li>
<li><p>And if you run a docker container with <code>--ulimit</code> set to be higher than the node but lower than the daemon itself, you won't find any problem, and won't need to give additional permissions like in the example bellow:</p></li>
</ul>

<pre><code>$ cat /proc/$(ps -A | grep dockerd | awk '{print $1}')/limits | grep "files"
Max open files            1048576              1048576              files     

$ docker run -d -it --rm --ulimit nofile=99999:99999 python python;
354de39a75533c7c6e31a1773a85a76e393ba328bfb623069d57c38b42937d03

$ cat /proc/$(ps -A | grep python | awk '{print $1}')/limits | grep "files"
Max open files            99999                99999                files 
</code></pre>

<ul>
<li>You can set a new limit for dockerd on the file <code>/etc/init.d/docker</code>:</li>
</ul>

<pre><code>$ cat /etc/init.d/docker | grep ulimit
                ulimit -n 1048576
</code></pre>

<ul>
<li>As for the container itself having a <code>ulimit</code> higher than the docker daemon, it's a bit more tricky, but doable, refer <a href="https://github.com/m3db/m3/issues/1671#issuecomment-502243705" rel="noreferrer">here</a>.</li>
<li>I saw you have tagged the Kubernetes tag, but didn't mention it in your question, but in order to make it work on Kubernetes, the container will need <code>securityContext.priviledged: true</code>, this way you can run the command <code>ulimit</code> as root inside the container, here an example:</li>
</ul>

<pre><code>image: image-name
  command: ["sh", "-c", "ulimit -n 65536"]
  securityContext:
    privileged: true
</code></pre>
