Set Cgroup Limits for All Users in Network

cgroupfreeipagroupslinux-networking

I have a FreeIPA user authentication set up. There are many users in the system already, along with many host systems (configured IPA clients). I want to set up cgroup restrictions on the tasks these users are doing (specifically, for CPU and memory/RAM). I could test it on a single host using a single test user (using these steps). However, this involves listing all users in each host, and managing and scaling it is difficult.

I thought of adding all IPA users to a system/user group on these host PCs and adding a cgrule for this group. However, this could require me to add each IPA user to a group on each host (creating another scaling problem). Is there a way to synchronize user groups for this particular setting?

I could find something on Group Merging but couldn't figure out how to make it work.

The FreeIPA server runs Fedora, and the hosts run Ubuntu (18.04 and 20.04). The hosts are simulation servers, so GUI access to the IPA users is needed. The cgroup limit should be on the tasks run by all these users. Ideally, I'd prefer to add the IPA users to a linux user group on the FreeIPA server (when adding the user to IPA) and have that synchronized across all the hosts. Then I would set a cgrule for this group. Is such a thing possible? It would greatly help me set up even docker access for users (add them to docker group).

Best Answer

Turns out all this is not needed. The groups created in the FreeIPA server are synchronized across clients without group merging. I created a group on the server portal and added users to it. Then, on each host, I set a limit on this group.

Some reference links

Related Solutions

Linux – FreeIPA in LXD/LXC containers – cannot switch user

Solved it! Sharing the solution, just in case somebody else with the same problem stumbles upon this thread.

In the default configuration, LXD / the Host-System does not allocate enough UIDs/GIDs to its containers, so that you cannot effectively become a user with an ID as high as picked by FreeIPA randomly.

The files /etc/subuid and /etc/subgid have entries that read root:100000:65536, which note the IDs that LXD will effectively use at the time of writing. Host UIDs/GIDs in the range of 100000-165536 get mapped to container IDs from 0-65536. The container, trying to use ID 161200001 in my case, is far over that boundary.

Based on this article https://insights.ubuntu.com/2015/10/30/nested-containers-in-lxd/ , I modified the mapped IDs, and specified which IDs FreeIPA may use. Changes to the sub*id-files might only work before initialising a container.

Specifically, this config worked:

LXD Host:

/etc/subuid: root:5000000:2500000

/etc/subgid: root:5000000:2500000

LXD Container with FreeIPA-Server:

initialise the server with ipa-server-install --idstart=1000000 --idmax=2000000

Here, the directory IDs range from 1.000.000 - 2.000.000, whereas the client has 2.500.000 IDs available. Due to the offset of 5.000.000, the host may also join that FreeIPA directory. Adjust the numbers as desired, YMMV.

CGroup configuration in CentOS 7

There is a similar question answered here: https://unix.stackexchange.com/questions/34334/how-to-create-a-user-with-limited-ram-usage

The limits imposed by ulimit and limits.conf is per process. I definitely wasn't clear on that point.

If you want to limit the total amount of memory a users uses (which is what you asked). You want to use cgroups.

In /etc/cgconfig.conf:
group memlimit {
    memory {
        memory.limit_in_bytes = 4294967296;
    }
}
This creates a cgroup that has a max memory limit of 4GiB.

In /etc/cgrules.conf:
luser   memory   memlimit/
This will cause all processes run by luser to be run inside the memlimit cgroups created in cgconfig.conf.

Best Answer

Related Solutions

Linux – FreeIPA in LXD/LXC containers – cannot switch user

CGroup configuration in CentOS 7

Related Topic