CODEWITHSUNDEEP
nginxdocker
justinvoelker
justinvoelker

Reputation: 573

Understanding Docker container resource usage

I have server running Ubuntu 16.04 with Docker 17.03.0-ce running an Nginx container. That server also has ConfigServer Security & Firewall installed. Shortly after starting the Nginx container I start receiving emails about "Excessive resource usage" with the following details:

Time:         Fri Mar 24 00:06:02 2017 -0400
Account:      systemd-timesync
Resource:     Process Time
Exceeded:     1820 > 1800 (seconds)
Executable:   /usr/sbin/nginx
Command Line: nginx: worker process
PID:          2302 (Parent PID:2077)
Killed:       No

I fully understand that I can add exe:/usr/sbin/nginx to csf.pignore to stop these email alerts but I would like to understand a few things first.

I'm sure there are other questions but basically, why is this being reported the way it is being reported?

Upvotes: 0

Views: 175

Answers (1)

KarlSt
KarlSt

Reputation: 176

I can at least answer the first two questions:

Unlike real VMs, Docker containers are simply a collection of processes run under the host system kernel. They just have a different view on certain system resources, including their own file hierarchy, their own PID namespace and their own /etc/passwd file. As a result, they will still show up if you ps aux on the host machine.

The nginx container's /etc/passwd includes a user 'nginx' with UID 104 that runs the nginx worker process. However, in the host's /etc/passwd, UID 104 might belong to a completely different user, such as systemd-timesync.

As a result, if you run ps aux | grep nginx in the container, you might see

nginx        7  0.0  0.0  32152  2816 ?        S    11:20   0:00 nginx: worker process

while on the host, you see

systemd-timesync   22004  0.0  0.0  32152  2816 ?        S    13:20   0:00 nginx: worker process

even though both are the are the same process (also note the different PID namespaces; in containers, PIDs are counted from 1 again).

As a result, container processes will still be subject to ConfigServer's resource monitoring, but they might show up with random, or even non-existent user accounts.

As to why nginx triggers the emails and other containers don't, I can only assume that nginx is the only one of your containers that crosses ConfigServer's resource thresholds.

Upvotes: 1

Related Questions