From: Max Kellermann <max@duempel.org>
To: Glauber Costa <glommer@parallels.com>
Cc: Li Zefan <lizf@cn.fujitsu.com>,
"Brian K. White" <brian@aljex.com>,
cgroups@vger.kernel.org, containers@lists.linux-foundation.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] new cgroup controller "fork"
Date: Fri, 4 Nov 2011 14:38:48 +0100 [thread overview]
Message-ID: <20111104133848.GA9116@Debian-60-squeeze-64-minimal> (raw)
In-Reply-To: <4EB3E47E.2080003@parallels.com>
On 2011/11/04 14:11, Glauber Costa <glommer@parallels.com> wrote:
> For other uses, we can watch the task counter increase until a
> certain value, and then set the limit to 0.
>
> Max, wouldn't it be enough for your use?
No. We do have a process limit already (I didn't publish it yet), but
we might adopt Frederic's new controller as soon as it hits our
servers. The fork controller complements it, and we have many others.
We run a shared CGI hosting platform with millions of accounts, and
many users have badly designed or even vulnerable PHP scripts. The
fork controller is very effective at stopping certain kinds of those.
Other controllers shall keep other problems small. This mix of many
different measures has been working very well for quite a few years.
We'll just keep that code on our private git repository .. rebasing on
new kernel releases is easy enough for me.
Max
next prev parent reply other threads:[~2011-11-04 13:38 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-11-03 16:22 Max Kellermann
2011-11-03 16:43 ` Frederic Weisbecker
2011-11-03 17:16 ` Max Kellermann
2011-11-03 17:26 ` Glauber Costa
2011-11-03 17:48 ` Max Kellermann
2011-11-03 17:50 ` Glauber Costa
2011-11-03 18:30 ` Max Kellermann
2011-11-03 18:34 ` Glauber Costa
2011-11-03 16:43 ` Glauber Costa
2011-11-03 16:59 ` Max Kellermann
2011-11-03 17:05 ` Frederic Weisbecker
2011-11-03 18:21 ` Alan Cox
2011-11-03 18:51 ` Max Kellermann
2011-11-03 18:56 ` Glauber Costa
2011-11-03 20:08 ` Matt Helsley
2011-11-03 19:03 ` Alan Cox
2011-11-03 19:20 ` Max Kellermann
2011-11-03 19:25 ` Glauber Costa
2011-11-03 20:13 ` Brian K. White
2011-11-03 21:54 ` Glauber Costa
2011-11-04 3:03 ` Li Zefan
2011-11-04 4:37 ` KAMEZAWA Hiroyuki
2011-11-04 13:11 ` Glauber Costa
2011-11-04 13:38 ` Max Kellermann [this message]
2011-11-04 13:59 ` Lennart Poettering
2011-11-03 17:31 ` richard -rw- weinberger
-- strict thread matches above, loose matches on Subject: below --
2011-02-17 13:31 Max Kellermann
2011-02-17 13:50 ` KAMEZAWA Hiroyuki
2011-02-17 14:09 ` Max Kellermann
2011-02-18 0:59 ` Paul Menage
2011-02-18 9:26 ` Max Kellermann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20111104133848.GA9116@Debian-60-squeeze-64-minimal \
--to=max@duempel.org \
--cc=brian@aljex.com \
--cc=cgroups@vger.kernel.org \
--cc=containers@lists.linux-foundation.org \
--cc=glommer@parallels.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lizf@cn.fujitsu.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®