Docker – Find out CPU and memory usage percent of Docker container

containerscpu-usagedockermemory usagemonitoring

Say I have a single machine and I want to find out how much of the physical CPU is used when I run a container.
I am not interested in inside-container stats.

Similarly I want to find out the memory usage. I am not interested in the memory usage percent inside the container.

For example, for memory, ps shows 2 things things:

$ ps -ax -o %mem,cmd | grep router
0.7 /usr/bin/docker run --rm -p 123:456 --name=the_router ...
5.3 java -jar the-router-fat.jar -conf /usr/verticles/conf/config.json

Second line is actually the command I execute inside the Docker container. The first line is the command I run to start the container.

Docker stats command shows a different number:

$ docker stats --format "table {{.Container}}\t{{.CPUPerc}}\t{{.MemPerc}}"
CONTAINER           CPU %               MEM %
1218ee798de6        0.15%               4.85%

Can I assume the value Docker stats return is the memory usage of the host system?

Best Answer

You can use docker stats to see the CPU and memory usage of docker containers. Check this question for reference : https://stackoverflow.com/questions/18956063/memory-usage-of-docker-containers

Related Solutions

Ssh – Restricting the network access of Docker container

It still makes sense to put some ingress rules inside your docker instance to help ward off attacks, but you will have to limit outbound (Internet) access from whatever upstream router the docker image connects with. The reason for this is, if you try to block outbound access with the firewall rules inside your instance, then if the instance is compromised those rules could be removed by the attacker. By blocking egress via the instance's router, you block outbound access even in the event of a compromise - the attacker would have to compromise the router as well.

Ok, so after receiving some commentary that explains that the filtering was intended for the container's host, it's a little clearer what is trying to be accomplished. In which case, on the host, you would add some rules similar to this:

iptables -A FORWARD -s lo.cal.sub.net -d con.tai.ner.ip -j ACCEPT
iptables -A FORWARD -s con.tai.ner.ip -d lo.cal.sub.net -j ACCEPT
iptables -A FORWARD -s ! lo.cal.sub.net -d con.tai.ner.ip -p tcp --dport sftp -j ACCEPT
iptables -A FORWARD -s con.tai.ner.ip -d ! lo.cal.sub.net -p tcp --sport sftp -j ACCEPT
iptables -A FORWARD -s con.tai.ner.ip -m state --state related,established -j ACCEPT
iptables -A FORWARD -s con.tai.ner.ip -j DROP

The first two rules are for access between the host and the container. The third rule says (roughly) that anything that isn't the host's subnet headed for SFTP is just OK by us; the fourth is the outbound rule that is basically a twin to the third; the fifth rule is a catch-all (in case there are other related ports that are used), although it shouldn't be needed, you could probably remove it; the last rule is the magic on that prevents access to anything other than the host subnet. Because access is given in the first few rules, it will never trigger unless none of the preceding rules apply, in which case we are saying "we don't care what you want, you didn't match anything you're approved for, so you can't get there from here". Inbound traffic from the outside will be satisfied by the 3rd and 4th rules.

Docker – Monitoring cpu and memory usage of Docker containers on Centos 7

Well, first you misspelled cgroup :)

After poking around, I found what you were looking for:

# cat /sys/fs/cgroup/memory/system.slice/docker-88018f8043d00669bbf865855ebc8a6ccc93a04ce588111e01d4e63739250340.scope/memory.stat 
cache 5251072
rss 380928
rss_huge 0
mapped_file 2662400
writeback 0
swap 0
pgpgin 1570
pgpgout 195
pgfault 344
pgmajfault 40
inactive_anon 278528
active_anon 102400
inactive_file 5083136
active_file 167936
unevictable 0
hierarchical_memory_limit 18446744073709551615
hierarchical_memsw_limit 18446744073709551615
total_cache 5251072
total_rss 380928
total_rss_huge 0
total_mapped_file 2662400
total_writeback 0
total_swap 0
total_pgpgin 1570
total_pgpgout 195
total_pgfault 344
total_pgmajfault 40
total_inactive_anon 278528
total_active_anon 102400
total_inactive_file 5083136
total_active_file 167936
total_unevictable 0
recent_rotated_anon 248
recent_rotated_file 41
recent_scanned_anon 248
recent_scanned_file 1495

Best Answer

Related Solutions

Ssh – Restricting the network access of Docker container

Docker – Monitoring cpu and memory usage of Docker containers on Centos 7

Related Topic