Re: [systemd-devel] nspawn container sees total host memory instead of MemoryMax value

2023-08-06 Thread Paulo Coghi - Coghi IT
oesn't have an equivalent. > > On Sun, Aug 6, 2023, 18:55 Paulo Coghi - Coghi IT > wrote: > >> I used "systemctl set-property >> systemd-nspawn@my-container-real-name.service MemoryMax=2G", to test >> defining a limit on RAM usage of a nspawn container. >&

[systemd-devel] nspawn container sees total host memory instead of MemoryMax value

2023-08-06 Thread Paulo Coghi - Coghi IT
I used "systemctl set-property systemd-nspawn@my-container-real-name.service MemoryMax=2G", to test defining a limit on RAM usage of a nspawn container. But after setting the limit, with the config being created at "/etc/systemd/system.control/" correctly, when I start the container and enter on i

[systemd-devel] How to limit network bandwidth on a nspawn container

2023-07-31 Thread Paulo Coghi - Coghi IT
After reading both nspwan and machinectl documentation, I couldn't find instructions on how to limit network bandwidth on a nspawn container through nspawn itself (or machinectl). Doesn nspawn and/or machinectl offer such an option and, if not, is it a problem to use external tools like "tc" (traf

[systemd-devel] About systemd.resource-control flags inside nspawn containers

2023-07-12 Thread Paulo Coghi - Coghi IT
Hello systemd community, I would like to know your opinion about disabling some resource accounting inside nspawn containers, considering that systemd is already doing the same job on the host, and doing it in duplicity would be a waste of resources and processing. What's your opinion on disablin

Re: [systemd-devel] Security and technical differences between systemd-nspawn and OpenVZ / LXC

2023-07-07 Thread Paulo Coghi - Coghi IT
I would like to thank both Mantas Mikulėnas and Vito Caputo *(are you from Italy, as well?)*. Both of your responses were on point and the landscape about systemd-nspawn is much more clear to me now. I'm planning to do some tests, simulating production scenarios, and I will give feedback here. T

Re: [systemd-devel] Security and technical differences between systemd-nspawn and OpenVZ / LXC

2023-07-06 Thread Paulo Coghi - Coghi IT
I apologize for my discovery journey. In 2015 Lennart was quoted[1] saying that "Initially we wrote it for testing purposes, but *nowadays we consider it ready for many production uses*. In fact CoreOS' rkt container tool makes use of it as the lower level container backend."[2] [1] https://unix.

Re: [systemd-devel] Security and technical differences between systemd-nspawn and OpenVZ / LXC

2023-07-06 Thread Paulo Coghi - Coghi IT
still remain? Or has the project "expanded" over the last 10 years in the direction of production environments usage as well? On Thu, Jul 6, 2023 at 5:19 PM Paulo Coghi - Coghi IT wrote: > Obs: when I mentioned the open source manager, what I meant was about my > startup doing the dev

Re: [systemd-devel] Security and technical differences between systemd-nspawn and OpenVZ / LXC

2023-07-06 Thread Paulo Coghi - Coghi IT
Obs: when I mentioned the open source manager, what I meant was about my startup doing the development, in case the systemd community is interested. On Thu, Jul 6, 2023 at 5:04 PM Paulo Coghi - Coghi IT wrote: > Hello Systemd Devel team, > > I've been using OpenVZ for 11 years

[systemd-devel] Security and technical differences between systemd-nspawn and OpenVZ / LXC

2023-07-06 Thread Paulo Coghi - Coghi IT
Hello Systemd Devel team, I've been using OpenVZ for 11 years in production without the security problems I faced with LXC. But as a non-official mainstream library of Linux kernel, there is always a gap. Virtuozzo is working on OpenVZ 9 with kernel 5.14 now, but it is still not released. Systemd