LXC, Cgroups and Advanced Linux Container Technology Lab Novell Training Services www.novell.com SUS15 ATT LIVE 2012 LAS VEGAS Novell, Inc. Copyright 2012-ATT LIVE-1-HARDCOPY PERMITTED. NO OTHER PRINTING, COPYING, OR DISTRIBUTION ALLOWED. Proprietary Statement Disclaimer Copyright © 2012 Novell, Inc. All rights reserved. Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied Novell, Inc., has intellectual property rights relating to technology embodied in warranties of merchantability or fitness for any particular purpose. the product that is described in this document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S. Further, Novell, Inc., reserves the right to revise this publication and to make patents listed on the Novell Legal Patents Web page changes to its content, at any time, without obligation to notify any person or (http://www.novell.com/company/legal/patents/) and one or more entity of such revisions or changes. Further, Novell, Inc., makes no additional patents or pending patent applications in the U.S. and in other representations or warranties with respect to any software, and specifically countries. disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to make changes to No part of this publication may be reproduced, photocopied, stored on a retrieval any and all parts of Novell software, at any time, without any obligation to notify system, or transmitted without the express written consent of the publisher. any person or entity of such changes. Novell, Inc. Any products or technical information provided under this Agreement may be 404 Wyman Street, Suite 500 subject to U.S. export controls and the trade laws of other countries. You agree to Waltham, MA 02451 comply with all export control regulations and to obtain any required licenses or U.S.A. classification to export, re-export or import deliverables. You agree not to export www.novell.com or re-export to entities on the current U.S. export exclusion lists or to any Novell Trademarks embargoed or terrorist countries as specified in the U.S. export laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological For Novell trademarks, see the Novell Trademark and Service Mark list weaponry end uses. See the Novell International Trade Services Web (http://www.novell.com/company/legal/trademarks/tmlist.html). page (http://www.novell.com/info/exports/) for more information on Third-Party Materials exporting Novell software. Novell assumes no responsibility for your failure to All third-party trademarks are the property of their respective owners. obtain any necessary export approvals. Software Piracy Throughout the world, unauthorized duplication of software is subject to both This Novell Training Manual is published solely to instruct students in the use of criminal and civil penalties. Novell networking software. Although third-party application software packages are used in Novell training courses, this is for demonstration purposes only and If you know of illegal copying of software, contact your local Software shall not constitute an endorsement of any of these software applications. Antipiracy Hotline. For the Hotline number for your area, access Novell’s World Wide Web page (http://www.novell.com) and look for the piracy Further, Novell, Inc. does not represent itself as having any particular expertise page under “Programs.” in these application software packages and any use by students of the same shall Or, contact Novell’s anti-piracy headquarters in the U.S. at 800-PIRATES (747- be done at the student’s own risk. 2837) or 801-861-7101. Novell, Inc. Copyright 2012-ATT LIVE-1-HARDCOPY PERMITTED. NO OTHER PRINTING, COPYING, OR DISTRIBUTION ALLOWED. Contents Version 1 Copying all or part of this manual, or distributing such copies, is strictly 3 prohibited. To report suspected copying, please call 1-800-PIRATES Novell, Inc. Copyright 2012-ATT LIVE-1-HARDCOPY PERMITTED. NO OTHER PRINTING, COPYING, OR DISTRIBUTION ALLOWED. Cgroups and LXC List of Figures 4 Copying all or part of this manual, or distributing such copies, is strictly prohibited. Version 1 To report suspected copying, please call 1-800-PIRATES Novell, Inc. Copyright 2012-ATT LIVE-1-HARDCOPY PERMITTED. NO OTHER PRINTING, COPYING, OR DISTRIBUTION ALLOWED. Introduction to Croup Section 1 Introduction to Croup In this section you install and begin using croup tools. Version 1 Copying all or part of this manual, or distributing such copies, is strictly 5 prohibited. To report suspected copying, please call 1-800-PIRATES Novell, Inc. Copyright 2012-ATT LIVE-1-HARDCOPY PERMITTED. NO OTHER PRINTING, COPYING, OR DISTRIBUTION ALLOWED. Cgroups and LXC 1.1 Use Linux Control Groups In this exercise you install, enable, and use Linux control groups (cgroups). Objectives: Task I: Install and Enable cgroups Special Instructions and Notes: (none) Task I: Install and Enable cgroups 1. Log in as the root user 2. Enter the following command to install the cgroups package(s) rpm -q libcgroup1 || zypper in -y libcgroup1 3. Enter the following command to activate cgroups: /etc/init.d/boot.cgroup start 4. Enter the following commands to enable cgroups to start at boot time: chkconfig boot.cgroup on 5. Enter the following command to see that cgroups are enabled: mount You should see several entries with /sys/fs/cgroup/subsystem as the mountpoint. Task II: Administer cgroups Directly via the File System Note: The use of taskset simplifies the example as it binds the xterm calls to the first core. You could use the cpuset subsystem to achieve the same effect, but that would require additional commands. If you don't bind them to the same core, you don't see the effect in top, as they will probably run on different cores, using all the available cpu time. 1. Open a terminal window and su - to the root user account. 2. Create two cgroups by creating directories in the /sys/fs/cgroup/cpu directory: cd /sys/fs/cgroup/cpu mkdir higherload lowerload 3. To view the files that were automatically created in the directories, enter 6 Copying all or part of this manual, or distributing such copies, is strictly prohibited. Version 1 To report suspected copying, please call 1-800-PIRATES Novell, Inc. Copyright 2012-ATT LIVE-1-HARDCOPY PERMITTED. NO OTHER PRINTING, COPYING, OR DISTRIBUTION ALLOWED. Introduction to Croup ls higherload 4. Set the values you want to use in the different groups: echo 6 > higherload/cpu.shares echo 4 > lowerload/cpu.shares 5. Start processes and assign them to one of the groups by entering taskset -c 0 xterm -bg orange & taskset -c 0 xterm -bg green & This will open two xterm windows with different background colors. 6. In the orange xterm, enter echo $$ > /sys/fs/cgroup/cpu/higherload/tasks This will add the shell running within the xterm to the tasks within the cpu/higherload cgroup. 7. In the green xterm, enter echo $$ > /sys/fs/cgroup/cpu/lowerload/tasks This will add the shell running within the xterm to the tasks within the cpu/lowerload cgroup. 8. In the the terminal window, enter top 9. In each of the xterms, enter md5sum /dev/urandom In the output of top, you should see one md5sum process with 60% CPU load, the other one with 40%. 10. View the content of one of the tasks files by entering cat /sys/fs/cgroup/cpu/higherload/tasks You should see two PIDs - the one that you added using the echo command, and that of the md5sum process that was added to the list automatically because child processes become part of the cgroup of their parent process. 11. In the green xterm window, put the md5sum process in the background and start another one by pressing Ctrl+z and then entering: bg md5sum /dev/urandom 12. Watch the output of top - the two md5sum processes in the lowerload cgroup should now each use 20% of the CPU load. 13. Close the green xterm window and watch the output of top - the remaining md5sum process should now use close to 100% of the CPU load. 14. Close the orange xterm window. Version 1 Copying all or part of this manual, or distributing such copies, is strictly 7 prohibited. To report suspected copying, please call 1-800-PIRATES Novell, Inc. Copyright 2012-ATT LIVE-1-HARDCOPY PERMITTED. NO OTHER PRINTING, COPYING, OR DISTRIBUTION ALLOWED. Cgroups and LXC 15. Remove the cgroups by entering rmdir /sys/fs/cgroup/cpu/{higher,lower}load Task III: Administer cgroups via cg* Commands In this task, you will use the cpuset subsystem to pin the processes to one CPU/core instead of the taskset command. 1. Open a terminal window and su - to the root user account. 1. Create two cgroups, using the cgcreate command: cgcreate -g cpu,cpuset:higherload cgcreate -g cpu,cpuset:lowerload This will create subdirectories in the cpu and cpuset subsystem directories. 2. Set the values you want to use, using the the following cgset command: cgset -r cpu.shares=6 -r cpuset.cpus=0 higherload cgset -r cpu.shares=4 -r cpuset.cpus=0 lowerload 3. The following is required for cpusets.cpus to work properly (see man cpuset) cgset -r cpuset.mems=0 higherload cgset -r cpuset.mems=0 lowerload 4. Start processes and assign them to one of the groups, using the following cgexec commands: cgexec -g cpu,cpuset:higherload xterm -bg orange & cgexec -g cpu,cpuset:lowerload xterm -bg green & 5. In the the terminal window, enter top 6. In each of the xterms, enter md5sum /dev/urandom In the output of top, you should see one md5sum process with 60% CPU load, the other one with 40%.