Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for setting pids_limit in docker plugin config. #11526

Merged
merged 5 commits into from
Dec 21, 2021

Conversation

shishir-a412ed
Copy link
Contributor

Currently, Nomad doesn't have a way to enforce pids_limit in containers, unless set by user in their job spec.
If a malicious user launches a container with a fork-bomb, that could exhaust entire nomad client host pids.

This PR will allow the operator to enforce pids_limit at Nomad client plugin config. User can still override that pids_limit in their job spec by setting pids_limit however it must be less than the limit defined on nomad client plugin config.

@vercel vercel bot temporarily deployed to Preview – nomad November 17, 2021 20:56 Inactive
@vercel vercel bot temporarily deployed to Preview – nomad November 17, 2021 20:57 Inactive
@vercel vercel bot temporarily deployed to Preview – nomad November 17, 2021 21:11 Inactive
@vercel vercel bot temporarily deployed to Preview – nomad November 17, 2021 23:11 Inactive
Signed-off-by: Shishir Mahajan <smahajan@roblox.com>
Copy link
Contributor

@lgfa29 lgfa29 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @shishir-a412ed this LGTM!

I pushed a few commits to add a CHANGELOG entry and reworded the docs a bit. I also added a new test case to check if the task-level config overrides the plugin config.

@github-actions
Copy link

github-actions bot commented Nov 6, 2022

I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 6, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants