Linux Labs

Containers: Docker and compose / Stage 10 of 11

Limits, OOMKilled and the user in a container

Not running Starting usually ~20 s
Leave the lesson

Step 9 of 9 · summary · 2 min

Summary

  • --memory puts a memory ceiling on all of a container's processes; outgrow it, and the OOM killer ends the largest process with SIGKILL.
  • Code 137 = 128 + 9 means "killed by SIGKILL"; a memory shortage is confirmed by .State.OOMKilled and an out of memory line in journalctl -k.
  • docker stats --no-stream shows usage and the ceiling; without --memory the ceiling is all of the machine's memory, while --cpus slows a process down with a quota.
  • A UID in a container is the same UID on the machine; --user UID:GID takes the process away from root.
  • The report at the start of the lesson broke off without an error because the build did not fit into the 32 MiB limit and the kernel killed it — twice, once on each try.
Ubuntu 24.04
Loading…