CGroup configuration in CentOS 7

centos7cgroupconfigurationmemorysystemd

I am using CentOS 7 and I have several users registered in system (UIDs: 1000, 1001, 1002, etc)

I want to restrict memory consumption for each user using cgroup and systemd.

The following commands work pretty well but the user with UID=1000 must be logged in.

systemctl set-property user-1000.slice MemoryLimit=3000M
systemctl daemon-reload

If the user is not login I receive the following error message

Failed to set unit properties on user-1000.slice: Unit user-1000.slice is not loaded.

Imagine I have 20 users and I want to set up memory restrictions for them. Should I log in manually or write some workaround script to do it in order to run systemctl set-property command for each user? Or some elegant and straightforward solution exists?

Best Answer

There is a similar question answered here: https://unix.stackexchange.com/questions/34334/how-to-create-a-user-with-limited-ram-usage

The limits imposed by ulimit and limits.conf is per process. I definitely wasn't clear on that point.

If you want to limit the total amount of memory a users uses (which is what you asked). You want to use cgroups.

In /etc/cgconfig.conf:

group memlimit {
    memory {
        memory.limit_in_bytes = 4294967296;
    }
}

This creates a cgroup that has a max memory limit of 4GiB.

In /etc/cgrules.conf:

luser   memory   memlimit/

This will cause all processes run by luser to be run inside the memlimit cgroups created in cgconfig.conf.