How does Marathon limit resources for directly called apps?

Question

I am experimenting with Mesos + Marathon and starting simple by creating a little "app" consisting of a shell script looping infinitely logging a message once every 5 seconds. When I provision that app I can allocate various memory and CPU resources which leads me to my question:

If Marathon is spawning a shell script directly then how can it limit that scripts resource usage? That script could do and launch anything to consume all available resources.

I understand that Docker or some other isolation mechanism will limit what a process can do but I have not configured this (explicitly). Is it creating some kind of container on the fly without me having to explicitly configure one? I am testing on OS X.

Answer 1

Mesos only supports "Posix" isolation on Macs, which is really more for monitoring than actual resource limiting, so testing Mesos on a Mac will not be able to demonstrate true resource isolation.

If you test Mesos on a Linux machine/VM, you can set:

--isolation='cgroups/cpu,cgroups/mem'

when starting each slave to enable cgroups isolation, which will create a container and run your script/process inside it. The cgroups isolator will throttle cpu utilization when a container/process exceeds its cpu share (not fixed cpus), and will kill a process (destroy the container) if it exceeds its memory limit.

Also note that Mesos 0.21 now supports a network isolator, and pluggable isolator modules so you could build your own gpu isolator, cache isolator, etc.

If you want to enable the Docker containerizer (0.20+), just set:

--containerizers='docker,mesos'

when starting the slaves, and then you can launch arbitrary docker images and run commands inside them. Docker still uses cgroups underneath, so the cgroups isolators are fully compatible with Docker images you run on Mesos.

If you're using Mesosphere packages, you can pass option to Mesos slave by creating a configuration file in /etc/mesos-slave, e.g.:

echo 'docker,mesos' > /etc/mesos-slave/containerizers