6,534
edits
Changes
m
Virtual Environmentcontainer.The sum of the <code>physpages</code> usage for all Virtual Environmentscontainers
Virtual Environmentscontainers.
Virtual Environment container individually.
Another example. Each object such as opened file or established network
connection consume certain resources. When the Virtual Environmentcontainer
is close to exhaustion of the resources allowed to him, it is
usually better to refuse creation of new object than to allow it but deny
<li>
These parameters improve fault isolation between applications in the
same Virtual Environmentcontainer. Failures or misbehavior of one applicationinside a Virtual Environment container is more likely to cause hitting a
limit on some auxiliary parameter and normal termination of this mis-
behaving application, rather than abnormal termination of some other
long-running application inside the same Virtual Environmentcontainer.
</li>
<li>
These parameters may be used to impose some administrative limits
on the Virtual Environment container (for example, to not allow the user to run
database servers by limiting the amount of [[shmpages]], or limiting the
number of simultaneous shell sessions through [[numpty]]).
The configuration of this parameter doesn't affect security and
stability of the whole system or isolation between Virtual Environmentscontainers.
Its configuration affects functionality and resource shortage reaction
of applications in the given Virtual Environment container only.
== shmpages ==
The <code>barrier</code> should be set equal to the <code>limit</code>.
The configuration of this parameter doesn't affect security and
stability of the whole system or isolation between Virtual Environmentscontainers.
Its configuration affects functionality and resource shortage reaction
of applications in the given Virtual Environment container only.
== physpages ==
Total number of RAM pages used by processes in this Virtual Environmenta container.
For memory pages used by several different Virtual Environments containers (mappings of
shared libraries, for example), only a fraction of a page is charged to each
corresponds to the total number of pages used in the system by all
For [[VSwap]]-enabled kernels, the <code>barrier</code> should be set to 0,and the <code>limit</code> limits the total size of RAM used by a container. For older kernels, <code>Physpagesphyspages</code> is an accounting-only parameter currently.In future OpenVZ releases, this parameter will allow to provide guaranteedamount of application memory, residing in RAM and not swappable.For compatibility with future versions, the The <code>barrier</code> of thisparameter should be set to <code>0</code> and the <code>limit</code> tothe maximal allowed value 'unlimited' ([[MAX_ULONGLONG_MAX]]).
== numfile ==
The <code>barrier</code> should be set equal to the <code>limit</code>.
The configuration of this parameter doesn't affect security and
stability of the whole system or isolation between Virtual Environmentscontainers.
Its configuration affects functionality and resource shortage reaction
of applications in the given Virtual Environment container only. Note: actually currently adjusting the <code>barrier</code> will change the kernel behaviour on "pre-charging" the numfile resource. If you change one you will most likely not notice any changes in container behaviour at all. This ability was added for researching purposes purely.
== numflock ==
The <code>barrier</code> should be set equal to the <code>limit</code>.
The configuration of this parameter doesn't affect security and
stability of the whole system or isolation between Virtual Environmentscontainers.
Its configuration affects functionality and resource shortage reaction
of applications in the given Virtual Environment container only.
However, in OpenVZ systems, the actual number of pseudo-terminals allowed
for one Virtual Environment container is limited to <code>256</code>.
== numsiginfo ==
to <code>1024</code> for the whole system.
In OpenVZ installations, <code>numsiginfo</code> limit applies to each
The <code>barrier</code> should be set equal to the <code>limit</code>.
Very high settings of the <code>limit</code> of this parameter may reduce
responsiveness of the system.
It is unlikely that any Virtual Environment container will need the limit greater than
the Linux default — <code>1024</code>.
[[UBC configuration examples]].
The configuration of this parameter doesn't affect security and
stability of the whole system or isolation between Virtual Environmentscontainers.
Its configuration affects functionality and resource shortage reaction
of applications in the given Virtual Environment container only.
== numiptent ==
Violation of this restriction may cause failures of operations with
IP packet filter tables (execution of <code>iptables(8)</code>)
in any Virtual Environment container or the host system,or failures of Virtual Environment container starts.
Also, large <code>numiptent</code> cause considerable slowdown of processing
of network packets. It is not recommended to allow Virtual Environmentscontainers
to create more than 200–300 <code>numiptent</code>.
== swappages ==
The amount of swap space to show in container.
{{Note|this parameter is only available in RHEL5-based kernel since version 028stab060.2, in 2.6.27 since kiprensky.}}
The configuration of this parameter doesn't affect security and
stability of the whole system or isolation between containers.
Its configuration only affects the way OpenVZ kernel reports about
available swap in a container. This is needed for some applications
which refuse to run inside a container unless the kernel
report that no less than some specific amount of swap is available.
If <code>limit</code> is set, its value is reported as the amount
of total swap space in a container.
If the <code>limit</code> is set to [[LONG_MAX]] (which is the
in-kernel default for this parameter), all the swap space values
parameters (total, used, free) are reported as 0.
The value of <code>barrier</code> for this beancounter is ignored.
The value of <code>held</code> shows how much swap space
is currently being used for this container.
