<p>Scanario: I have a container image that needs to run with <code>net.core.somaxconn</code> > default_value. I am using Kubernetes to deploy and run in GCE.</p>

<p>The nodes (vms) in my cluster are configured with correct <code>net.core.somaxconn</code> value. Now the challenge is to start the docker container with flag <code>--sysctl=net.core.somaxconn=4096</code> from kubernetes. I cannot seem to find the proper documentation to achieve this.</p>

<p>Am I missing something obvious?  </p>

<p><strong>Solution 1</strong>: use <a href="https://stackoverflow.com/questions/43032406/gke-cant-disable-transparent-huge-pages-permission-denied/43081893#43081893">this answer</a> as a template to see how to configure the whole node to that sysctl value; you can use something like <code>echo 4096 &gt;/proc/sys/net/core/somaxconn</code>. Thereafter you can put a label on the nodes that use a VM with the needed sysctl configuration and use nodeSelector in the Pod spec to force scheduling to those nodes. (This only works with <em>non</em> namespaced settings; sys.net.core.somaxconn appears to be namespaced. I would like to leave this solution here as it might help others.)</p>

<p><strong>Solution 2</strong>: again, starting from <a href="https://stackoverflow.com/questions/43032406/gke-cant-disable-transparent-huge-pages-permission-denied/43081893#43081893">same answer</a> you can add <code>--experimental-allowed-unsafe-sysctls=net.core.somaxconn</code> to the <code>kubelet</code> command line (This only works with <em>namespaced</em> settings; sys.net.core.somaxconn is namespaced). Then you can simply do something like (<a href="https://kubernetes.io/docs/concepts/cluster-administration/sysctl-cluster/#enabling-unsafe-sysctls" rel="nofollow noreferrer">source</a>):</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: sysctl-example
  annotations:
    security.alpha.kubernetes.io/sysctls: net.core.somaxconn=4096
</code></pre>

<p>I hope this helps..</p>
