title: Where does a container get it's limits (no_file and similar) from when not set by the user?
body: <p>This is something I've struggled to find anything more than anecdotal answers for and I'd really like to find some solid information on this.</p>
  
  <p>This is my situation (I'll be focusing on the no_file limit as it's of principle interest to me):</p>
  
  <ul>
  <li>I have a container.</li>
  <li>Swarm is not being use</li>
  <li>I can use docker inspect it and see that <code>"Ulimits": null</code>.</li>
  <li>I use a compose file</li>
  <li>host and container are running linux (ubuntu)</li>
  <li>I do not set <a href="https://docs.docker.com/engine/reference/commandline/run/#set-ulimits-in-container---ulimit" rel="nofollow noreferrer">ulimits via args to docker</a></li>
  <li>I do not set <a href="https://docs.docker.com/compose/compose-file/#ulimits" rel="nofollow noreferrer">ulimits in the compose file</a></li>
  <li>I do not set limits via <a href="https://docs.docker.com/compose/compose-file/#resources" rel="nofollow noreferrer">resources in the compose file</a></li>
  <li>On the host I can see that all of <code>/etc/default/docker</code> is commented out</li>
  <li>On the host I start docker with systemd which <a href="https://stackoverflow.com/questions/30620658/how-to-display-the-docker-current-configuration">seems to</a> ignore <code>/etc/default/docker</code> anyway</li>
  <li>On the host there is no <code>--config-file</code> option being passed to <code>dockerd</code></li>
  <li>On the host there is no <code>/etc/docker/daemon.json</code> file (these last 2 being relevant <a href="https://docs.docker.com/engine/reference/commandline/dockerd//#daemon-configuration-file" rel="nofollow noreferrer">due to this</a>)</li>
  <li>On the host <code>ulimit -Hn</code> gives <code>1048576</code></li>
  <li>In the container <code>ulimit -Hn</code> gives <code>1048576</code></li>
  <li>In the container <code>/etc/sysctl.conf</code> is commented out (And is ignored by docker containers anyway iirc)</li>
  <li>In the container <code>/etc/sysctl.d</code> is an empty directory</li>
  <li>In the container <code>/etc/security/limits.conf</code> is commented out (And is ignored by docker containers anyway iirc)</li>
  <li>In the container <code>/etc/security/limits.d</code> is an empty directory</li>
  </ul>
  
  <p>I'm aware (from <a href="https://stackoverflow.com/a/27617681/574033">answers like this one</a>) that the host values do impact the container. But not what takes preference.</p>
  
  <p>The best leads I've found are as follows:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/a/50145392/574033">https://stackoverflow.com/a/50145392/574033</a></li>
  <li><a href="https://stackoverflow.com/a/46233327/574033">https://stackoverflow.com/a/46233327/574033</a></li>
  </ul>
  
  <p>What then muddies the water is that <code>/lib/systemd/system/docker.service</code> has a line in the <code>[Service]</code> section that reads <code>LimitNOFILE=1048576</code>. So then I'm not sure if this is setting a hard limit on the docker deamon pid (ala ulimits) and, if so, whether this take precedence over the host's established limits (one would assume so right?).</p>
  
  <p>There is an extent to which it "doesn't matter" in that as long as I have the number in the range I need it should be fine. However I'd really like to be able to understand the actual behaviour here, and know if there is any official information on what the behavior is (or should be).</p>
  
  <p>Thank you.</p>