Docker Docker Security Resource Limits CPU Memory cpus memory memoryswap

1. Core Command / Concept

Set resource limits for Docker containers to prevent them from consuming excessive CPU or memory. docker run -c/--cpu-shares/-m/--memory

2. Step-by-Step (numbered)

1. Check the current CPU and memory usage of your system: docker stats
2. Create a new container with limited CPU and memory: docker run -it --cpu-shares=1024 --memory=512m ubuntu /bin/bash
3. Check the container's resource usage: docker stats <container_id>
4. ⚠️ Delete the container: docker rm <container_id>
5. Create a new container with limited CPU and memory swap: docker run -it --cpu-shares=1024 --memory=512m --memory-swap=0 ubuntu /bin/bash
6. Check the container's resource usage: docker stats <container_id>
7. ⚠️ Delete the container: docker rm <container_id>

3. Real Commands with Examples

1. Purpose: Limit a container's CPU usage to 50% of the host's CPU.
   Command: docker run -it --cpu-shares=512 ubuntu /bin/bash Flags: -c or --cpu-shares sets the CPU shares, and --cpu-shares=512 sets the value to 512.

2. Purpose: Limit a container's memory usage to 256 MB.
   Command: docker run -it --memory=256m ubuntu /bin/bash Flags: -m or --memory sets the memory limit, and --memory=256m sets the value to 256 MB.

3. Purpose: Limit a container's memory swap usage to 0 MB.
   Command: docker run -it --memory=512m --memory-swap=0 ubuntu /bin/bash Flags: -m or --memory sets the memory limit, --memory-swap sets the swap limit, and --memory-swap=0 sets the value to 0 MB.

4. Common Errors (3-5)

1. Error message: "Error response from daemon: failed to create shim: OCI runtime create failed: container_linux.go:380: starting container process caused: process_linux.go:459: container init caused: running prestart hook 0 caused: failed to start hook: OCI runtime error: container_linux.go:380: starting container process caused: process_linux.go:459: container init caused: running prestart hook 0 caused: failed to start hook: failed to execute prestart hook: exit status 1".
   Why it happens: The container's resource limits are too low.
   One-line fix: docker run -it --cpu-shares=1024 --memory=512m ubuntu /bin/bash

2. Error message: "Error response from daemon: failed to create shim: OCI runtime create failed: container_linux.go:380: starting container process caused: process_linux.go:459: container init caused: running prestart hook 0 caused: failed to start hook: OCI runtime error: container_linux.go:380: starting container process caused: process_linux.go:459: container init caused: running prestart hook 0 caused: failed to start hook: failed to execute prestart hook: exit status 1".
   Why it happens: The container's memory swap limit is too low.
   One-line fix: docker run -it --cpu-shares=1024 --memory=512m --memory-swap=0 ubuntu /bin/bash

3. Error message: "Error response from daemon: failed to create shim: OCI runtime create failed: container_linux.go:380: starting container process caused: process_linux.go:459: container init caused: running prestart hook 0 caused: failed to start hook: OCI runtime error: container_linux.go:380: starting container process caused: process_linux.go:459: container init caused: running prestart hook 0 caused: failed to start hook: failed to execute prestart hook: exit status 1".
   Why it happens: The container's resource limits are too high.
   One-line fix: docker run -it --cpu-shares=512 --memory=256m ubuntu /bin/bash

5. Quick Checks (3 scenarios)

1. Situation: A container is consuming 100% of the host's CPU.
   Command to run: docker stats Correct response: The container's CPU usage is below 100%.

2. Situation: A container is consuming 100% of the host's memory.
   Command to run: docker stats Correct response: The container's memory usage is below 100%.

3. Situation: A container is consuming 100% of the host's memory swap.
   Command to run: docker stats Correct response: The container's memory swap usage is below 100%.

6. Last-Minute Reference

• ⚠️ --cpu-shares is a deprecated flag, use --cpu-quota instead.
• --cpu-quota sets the CPU quota in units of 100ns.
• --memory sets the memory limit in bytes.
• --memory-swap sets the swap limit in bytes.
• --cpu-shares sets the CPU shares in units of 100.
• docker run is the command to run a container.
• docker stats is the command to check container resource usage.
• docker rm is the command to delete a container.
• ⚠️ docker rm deletes all stopped containers by default.