Menu
I'm trying to minimize damage made by fork bombs inside of a docker container.
I'm using pam_limits and /etc/security/limits.conf file is
1000:1128 hard nproc 40
1000:1128 soft nproc 40
This means that any user with id in range [1000..1128] can have up to 40 processes. This works fine if I run forkbomb in shell by user with such id.
But when I run fork bomb inside a docker container these limits are not being applied, so when I run command
# docker run -u 1000 ubuntu bash -c ":() { : | : & }; :; while [[ true ]]; do sleep 1; done"
I have as much processes as possible and all these processes belong to user with id=1000.
What's wrong? How can I fix it?
544
Container-based application design encourages certain principles. One of these principles is that there should just be one process running in a container. That is to say, a Docker container should have just one program running inside it. Docker is efficient at creating and starting containers.
It's ok to have multiple processes, but to get the most benefit out of Docker, avoid one container being responsible for multiple aspects of your overall application. You can connect multiple containers using user-defined networks and shared volumes.
To limit the maximum amount of memory usage for a container, add the --memory option to the docker run command. Alternatively, you can use the shortcut -m . Within the command, specify how much memory you want to dedicate to that specific container.
Docker provides ways to control how much memory, or CPU a container can use, setting runtime configuration flags of the docker run command. This section provides details on when you should set such limits and the possible implications of setting them. Consult your operating system's documentation for enabling them.
When running a container, there is an option to limit the number of pids:
--pids-limit: Tune container pids limit (set -1 for unlimited)
The command would be:
docker container run --pids-limit 100 your-image
Reference: https://docs.docker.com/engine/reference/commandline/run/#options
89
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
