SYSTEMD.RESOURCE-CONTROL(5) systemd.resource-control (NAME) systemd.resource-control - (cgroups) systemd (SYNOPSIS) slice.slice, scope.scope, service.service, socket.socket, mount.mount, swap.swap (DESCRIPTION) (services) (slices) (scopes) (sockets) (mount points) (swap devices) . (Control Groups cgroups) . . systemd.unit(5) systemd.slice(5), systemd.scope(5), systemd.service(5), systemd.socket(5), systemd.mount(5) systemd.swap(5) . [Slice] [Scope] [Service] [Socket] [Mount] [Swap] . systemd systemd.exec(5) . . cgroup (siblings) cgroup . cgroup . systemd . CPUWeight= cpu TasksMax= pids . MemoryAccounting=/TasksAccounting=/IOAccounting= . cgroup . . Delegate= ( ). (delegatee) . systemd ( user@.service) . cgroup DisableControllers= ( ). 1. -.slice / \ /-----/ \-------------\ / \ system.slice user.slice / \ / \ / \ / \ / \ user@42.service user@1000.service / \ Delegate= Delegate=yes a.service b.slice / \ CPUWeight=20 DisableControllers=cpu / \ / \ app.slice session.slice / \ CPUWeight=100 CPUWeight=100 / \ b1.service b2.service CPUWeight=1000 cpu b1.service b2.service . system.slice user.slice (CPU) . user.slice user@1000.service . app.slice session.slice cpu CPU nice . 42 cgroup . system.slice 1:6 a.service 5:6 b.slice b.slice 100 cpu.weight CPUWeight= . CPUWeight= b2.service DisableControllers= b.slice cpu b1.service b2.service nice . systemd.unit(5) (drop-in) *.d/ . . . user-nnn.slice . 1000 /etc/systemd/system/user-1000.slice /etc/systemd/system/user-1000.slice.d/*.conf /etc/systemd/system/user-.slice.d/*.conf . . API (New Control Group Interfaces)[1] . (IMPLICIT DEPENDENCIES) : o Slice= Requires= After= . (OPTIONS) : (CPU) CPUAccounting= (CPU) . . . DefaultCPUAccounting= systemd- system.conf(5) . cgroup (unified cgroup hierarchy) CPU . 208 . CPUWeight=weight, StartupCPUWeight=weight cpu . "idle" : o CPU . "cpu.weight" . 1 10000 . (unset) 100 . 2 (Control Groups v2)[2] CFS (CFS Scheduler)[3] . CPU . . o "idle" cgroup " " (idle scheduling) CPU cgroup . cgroup "cpu.idle" . cgroup-v2 cgroup-v1 . StartupCPUWeight= (startup) (shutdown) CPUWeight= . StartupCPUWeight= . cpu (session-id) "The autogroup feature" sched(7) . cpu . 232 . CPUQuota= cpu . CPU . "%" . CPU . CPU > 100% . "cpu.max" "cpu.cfs_quota_us" (legacy) . 2 (Control Groups v2)[2] CFS (CFS Bandwidth Control)[4] . CPUQuota= . : CPUQuota=20% 20% CPU . 213 . CPUQuotaPeriodSec= cpu . CPUQuota= . "ms" ( "s" ). 100ms . [1ms, 1000ms] . 1ms . CPUQuotaPeriodSec= . "cpu.max" "cpu.cfs_period_us" . 2 (Control Groups v2)[2] CFS (CFS Scheduler)[3] . : CPUQuotaPeriodSec=10ms 10 . 242 . AllowedCPUs=, StartupAllowedCPUs= cpuset . . (indices) CPU . CPU . AllowedCPUs= StartupAllowedCPUs= . EffectiveCPUs= . StartupAllowedCPUs= AllowedCPUs= . StartupAllowedCPUs= . . 244 . MemoryAccounting= memory . . . . DefaultMemoryAccounting= systemd-system.conf(5) . 208 . MemoryMin=bytes, MemoryLow=bytes, StartupMemoryLow=bytes, DefaultStartupMemoryLow=bytes memory . . (memory reclaiming) . MemoryLow= (OOM killer) . (ancestors) ( ). MemoryMin= MemoryLow= . . . K M G T ( 1024) . . "infinity" . "memory.min" "memory.low" . (Memory Interface Files)[5] . DefaultMemoryMin= DefaultMemoryLow= "memory.min" "memory.low" MemoryMin= MemoryLow= DefaultStartupMemoryLow= StartupMemoryLow= . "memory.min" "memory.low" . 5.7 cgroup2 "memory_recursiveprot" . StartupMemoryLow= MemoryMin= . StartupMemoryLow= . 240 . MemoryHigh=bytes, StartupMemoryHigh=bytes memory . (throttling limit) . . . . K M G T ( 1024) . . "infinity" . "memory.high" . (Memory Interface Files)[5] . EffectiveMemoryHigh= ( EffectiveMemoryMax= ). StartupMemoryHigh= MemoryHigh= . StartupMemoryHigh= . 231 . MemoryMax=bytes, StartupMemoryMax=bytes memory . . (OOM killer) . MemoryHigh= MemoryMax= . . K M G T ( 1024) . . "infinity" . "memory.max" . (Memory Interface Files)[5] . EffectiveMemoryMax= ( ). StartupMemoryMax= MemoryMax= . StartupMemoryMax= . 231 . MemorySwapMax=bytes, StartupMemorySwapMax=bytes memory . (swap) . swap . K M G T swap ( 1024) . swap . "infinity" swap . "memory.swap.max" . (Memory Interface Files)[5] . StartupMemorySwapMax= MemorySwapMax= . StartupMemorySwapMax= . 232 . MemoryZSwapMax=bytes, StartupMemoryZSwapMax=bytes memory . zswap . Zswap swap . swap RAM . (faulted back) . Zswap[6] . . K M G T ( 1024) . "infinity" . "memory.zswap.max" . (Memory Interface Files)[5] . StartupMemoryZSwapMax= MemoryZSwapMax= . StartupMemoryZSwapMax= . 253 . MemoryZSwapWriteback= memory . . true Zswap false . true . (writeback) swap / (I/O) Zswap . Zswap[6] . 256 . AllowedMemoryNodes=, StartupAllowedMemoryNodes= cpuset . NUMA . NUMA . NUMA . AllowedMemoryNodes= StartupAllowedMemoryNodes= NUMA . EffectiveMemoryNodes= . StartupAllowedMemoryNodes= AllowedMemoryNodes= . StartupAllowedMemoryNodes= . . 244 . TasksAccounting= pids . (tasks) . . . . . DefaultTasksAccounting= systemd-system.conf(5) . 227 . TasksMax=N pids . . ( ) . . "infinity" . "pids.max" . pids (pids controller)[7] . EffectiveTasksMax= . DefaultTasksMax= systemd-system.conf(5) . 227 . / (I/O) IOAccounting= io . / (Block I/O) . . / . DefaultIOAccounting= systemd-system.conf(5) . 230 . IOWeight=weight, StartupIOWeight=weight io . / . ( 1 10000) Block I/O . "io.weight" 100 . IO (IO Interface Files)[8] . I/O / . I/O . StartupIOWeight= IOWeight= . . 230 . IODeviceWeight=device weight io . / . ( 1 10000) . (: "/dev/sda 1000"). . "io.weight" 100 . . IO (IO Interface Files)[8] . I/O loopback . . 1:1 dm-crypt/LUKS . (volume management) RAID . 230 . IOReadBandwidthMax=device bytes, IOWriteBandwidthMax=device bytes io . / . (work-conserving) . ( ) . . K M G T 1000 . (: "/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 5M"). "io.max" . . IO (IO Interface Files)[8] . IODeviceWeight= . 230 . IOReadIOPSMax=device IOPS, IOWriteIOPSMax=device IOPS io . / (IOs-Per- Second IOPS) . work-conserving . IOPS IOPS . . IOPS K M G T KiloIOPS MegaIOPS GigaIOPS TeraIOPS 1000 . (: "/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 1K"). "io.max" . IOPS . IO (IO Interface Files)[8] . IODeviceWeight= . 230 . IODeviceLatencyTargetSec=device target io . I/O . . (: "/dev/sda 25ms"). . "io.latency" . . IO (IO Interface Files)[8] . "IOAccounting=yes" . . IODeviceWeight= . 240 . IPAccounting= . true IPv4 IPv6 . IPv4 IPv6 . IPv4 IPv6 ( ). . . -- . DefaultIPAccounting= systemd-system.conf(5) . . 235 . IPAddressAllow=ADDRESS[/PREFIXLENGTH]..., IPAddressDeny=ADDRESS[/PREFIXLENGTH]... IP AF_INET AF_INET6 . IPv4 IPv6 "/" . (host) (32 IPv4 128 IPv6). ( ) . . . (ingress) (egress) . IP IP . : o IP IPAddressAllow= . o IP IPAddressDeny= . o . IP (allow-list) IPAddressDeny=any ( -.slice system.slice - systemd.special(7) ) IPAddressAllow= . IP . IP . IP . . . . IPv4 IPv6 . : 1. / +-------------------+---------------------+------------------------------+ | | | | | | | | +-------------------+---------------------+------------------------------+ |any | 0.0.0.0/0 ::/0 | | +-------------------+---------------------+------------------------------+ |localhost | 127.0.0.0/8 ::1/128 | | | | | | | | | loopback | +-------------------+---------------------+------------------------------+ |link-local | 169.254.0.0/16 | | | | fe80::/64 | IP | | | | - | +-------------------+---------------------+------------------------------+ |multicast | 224.0.0.0/4 | | | | ff00::/8 | | | | | IP | +-------------------+---------------------+------------------------------+ ( eBPF ). . IP . "+" . 235 . SocketBindAllow=bind-rule, SocketBindDeny=bind-rule bind(2) . (bound) . bind-rule address-family transport-protocol ip-ports . bind-rule := { [address-family:][transport-protocol:][ip-ports] | any } address-family := { ipv4 | ipv6 } transport-protocol := { tcp | udp } ip-ports := { ip-port | ip-port-range } address-family ipv4 ipv6 . IPv4 IPv6 transport-protocol ip-port . transport-protocol tcp udp . . ip-port 1...65535 0 . ip-port-range := ip-port-low-ip-port-high ip-port-low ip-port-high 1...65535 . any . SocketBindAllow= SocketBindDeny= . SocketBindAllow= SocketBindDeny= . SocketBindAllow= SocketBindDeny= 128 . o SocketBindAllow= . o SocketBindDeny= . o . cgroup-bpf cgroup/bind4 cgroup/bind6 . bind(2) (network namespace) . : bind() . : ... # IPv6 10000. [Service] SocketBindAllow=ipv6:10000-65535 SocketBindDeny=any ... # IPv4 IPv6 1234 4321. [Service] SocketBindAllow=1234 SocketBindAllow=4321 SocketBindDeny=any ... # IPv6. [Service] SocketBindDeny=ipv6 ... # IPv4 IPv6. [Service] SocketBindDeny=any ... # TCP [Service] SocketBindAllow=tcp SocketBindDeny=any ... # IPv6/TCP [Service] SocketBindAllow=ipv6:tcp SocketBindDeny=any ... # 10000-65535 IPv4/UDP. [Service] SocketBindAllow=ipv4:udp:10000-65535 SocketBindDeny=any ... "+" . 249 . RestrictNetworkInterfaces= . . ( allow-list). "~" : ( deny-list). . . ( ) ( ) . . loopback ("lo") . 1: (allow-list) RestrictNetworkInterfaces=eth1 RestrictNetworkInterfaces=eth2 eth1 eth2 . 2: (deny-list) RestrictNetworkInterfaces=~eth1 eth2 eth1 eth2 . 3: RestrictNetworkInterfaces=eth1 eth2 RestrictNetworkInterfaces=~eth1 eth2 . "+" . 250 . NFTSet=family:table:set cgroup NFT[9] . (selectors) . NFT cgroup cgroup systemd . DynamicUser= . NFT . (tuple) ( "cgroup", "user" "group") NFT ( "arp", "bridge", "inet", "ip", "ip6" "netdev") . NFT . NFT ("cgroup" "user" "group") . NFT . systemd ( ) NFT . . 2. type +-------------+-----------------------+---------------------+ | | | | | | | NFT | | | | | +-------------+-----------------------+---------------------+ |"cgroup" | | "cgroupsv2" | | | | | | | | | +-------------+-----------------------+---------------------+ |"user" | | "meta skuid" | | | | | +-------------+-----------------------+---------------------+ |"group" | | "meta skgid" | | | | | +-------------+-----------------------+---------------------+ NFT systemctl daemon-reload . : [Unit] NFTSet=cgroup:inet:filter:my_service user:inet:filter:serviceuser NFT : table inet filter { set my_service { type cgroupsv2 } set serviceuser { typeof meta skuid } chain x { socket cgroupv2 level 2 @my_service accept drop } chain y { meta skuid @serviceuser accept drop } } . 255 . BPF IPIngressFilterPath=BPF_FS_PROGRAM_PATH, IPEgressFilterPath=BPF_FS_PROGRAM_PATH BPF IP AF_INET AF_INET6 . BPF BPF (/sys/fs/bpf/) . ( ) . IPAddressAllow= IPAddressDeny= . . (attached) . . BPF_FS_PROGRAM_PATH IPIngressFilterPath= (ingress hook) BPFProgram= BPFProgram=ingress:BPF_FS_PROGRAM_PATH cgroup . IPEgressFilterPath= egress . IP . IP . IP . ( eBPF ). . ( Delegate=yes) . 243 . BPFProgram=type:program-path BPFProgram= BPF cgroup . ( IPEgressFilterPath= IPIngressFilterPath= .) cgroup-bpf BPF BPF cgroup-bpf . bpf.h[10] . BPF (BPF documentation)[11] . BPF BPF ":" : type:program-path. BPF BPF bpftool(8) . : egress, ingress, sock_create, sock_ops, device, bind4, bind6, connect4, connect6, post_bind4, post_bind6, sendmsg4, sendmsg6, sysctl, recvmsg4, recvmsg6, getsockopt setsockopt. inode BPF bpffs ( /sys/fs/bpf/ ). ( BPF ) ( ). BPFProgram= . / : . BPF egress program-path IPEgressFilterPath= BPFProgram= BPFProgram= cgroup . ingress IPIngressFilterPath= . BPF BPFProgram= BPF multi cgroup type cgroup cgroup . : BPFProgram=egress:/sys/fs/bpf/egress-hook BPFProgram=bind6:/sys/fs/bpf/sock-addr-hook 249 . DeviceAllow= . : r, w, m reading () writing () (mknod). eBPF . PrivateDevices= . systemd.exec(5) . /dev/ "char-" "block-" /proc/devices . . (globbing) "*" "?" . ( !). / (major/minor) /dev/char/ /dev/block/ . major/minor . : /dev/sda5 ATA SCSI . "char-pts" "char-alsa" TTY ALSA . "char-cpu/*" CPU . (resolvable) . . After=modprobe@xyz.service Wants=modprobe@xyz.service . : ... [Unit] Wants=modprobe@loop.service After=modprobe@loop.service [Service] DeviceAllow=block-loop DeviceAllow=/dev/loop-control ... "+" . 208 . DevicePolicy=auto|closed|strict : strict . 208 . closed /dev/null, /dev/zero, /dev/full, /dev/random /dev/urandom . 208 . auto DeviceAllow= . . 208 . "+" . 208 . (Control Group) Slice= (slice unit) . system.slice ( ). system.slice . systemd . . . DefaultDependencies=no systemd.service(5) "Default Dependencies" . 208 . Delegate= . . ( User= ) . : ( ) . ( ) . true . false ( ). . . . false . . . : cpu, cpuacct, cpuset, io, blkio, memory, devices, pids, bpf-firewall bpf-devices. . . cgroup . (Control Group APIs and Delegation)[12] . 218 . DelegateSubgroup= . ( !) . (off) . ( cgroup.procs ). Delegate= . "" ExecStart= ExecReload= . .control . ( / ). . ("") . 254 . DisableControllers= . . . . . DisableControllers= . DisableControllers= . cgroup systemd . : cpu, cpuacct, cpuset, io, blkio, memory, devices, pids, bpf-firewall bpf-devices. 240 . ManagedOOMSwap=auto|kill, ManagedOOMMemoryPressure=auto|kill systemd-oomd.service(8) cgroups . auto . kill systemd-oomd . cgroup oomd.conf(5) systemd-oomd cgroup SIGKILL . (kill behavior) systemd- oomd.service(8) oomd.conf(5) . kill After= Wants= systemd-oomd.service DefaultDependencies=no . auto systemd-oomd cgroup . cgroup kill auto systemd-oomd . 247 . ManagedOOMMemoryPressureLimit= oomd.conf(5) cgroup (override) . 0% 100% . 0% oomd.conf(5) . ManagedOOMMemoryPressure=kill . 247 . ManagedOOMMemoryPressureDurationSec= oomd.conf(5) cgroup . "ms" "s" systemd.time(7) . 1s . oomd.conf(5) . ManagedOOMMemoryPressure=kill . 257 . ManagedOOMPreference=none|avoid|omit cgroup systemd-oomd . avoid omit ( xattr(7) ) . swap systemd-oomd cgroup root . systemd-oomd cgroup root cgroup cgroup . systemd-oomd -.slice /user.slice/user-1000.slice/user@1000.service/ UID 1000 -.slice UID 0 . /user.slice/user-1000.slice/user@1000.service/ . avoid systemd-oomd cgroup . omit systemd-oomd cgroup . avoid omit systemd-oomd . cgroup cgroup . none systemd-oomd systemd-oomd.service(8) oomd.conf(5) . 248 . MemoryPressureWatch= . "auto" "skip" . "no" $MEMORY_PRESSURE_WATCH /dev/null . "yes" . cgroup memory.pressure . $MEMORY_PRESSURE_WATCH . MemoryPressureThresholdSec= $MEMORY_PRESSURE_WRITE . "auto" . "skip" . . . systemd (Memory Pressure Handling in systemd)[13] . sd-event(3) sd_event_add_memory_pressure(3) . DefaultMemoryPressureWatch= systemd-system.conf(5) . 254 . MemoryPressureThresholdSec= MemoryPressureWatch= . 2 . DefaultMemoryPressureThresholdSec= systemd-system.conf(5) ( 200ms ). "ms" "s" systemd.time(7) . 254 . Coredump CoredumpReceive= . coredump cgroup . CoredumpReceive=yes Delegate=yes . false . systemd-coredump coredump cgroup CoredumpReceive=yes Delegate=yes systemd-coredump coredump systemd-coredump . systemd-coredump(8) . 255 . (HISTORY) systemd 252 ( 1 (Control Groups version 1)[14]) (deprecated) : CPUShares=weight, StartupCPUShares=weight, MemoryLimit=bytes, BlockIOAccounting=, BlockIOWeight=weight, StartupBlockIOWeight=weight, BlockIODeviceWeight=device weight, BlockIOReadBandwidth=device bytes, BlockIOWriteBandwidth=device bytes. cgroup . 252 . (SEE ALSO) systemd(1), systemd-system.conf(5), systemd.unit(5), systemd.service(5), systemd.slice(5), systemd.scope(5), systemd.socket(5), systemd.mount(5), systemd.swap(5), systemd.exec(5), systemd.directives(7), systemd.special(7), systemd-oomd.service(8), : 2 (Control Groups v2)[2] (NOTES) 1. New Control Group Interfaces https://systemd.io/CONTROL_GROUP_INTERFACE 2. Control Groups v2 https://docs.kernel.org/admin-guide/cgroup-v2.html 3. CFS Scheduler https://docs.kernel.org/scheduler/sched-design-CFS.html 4. CFS Bandwidth Control https://docs.kernel.org/scheduler/sched-bwc.html 5. Memory Interface Files https://docs.kernel.org/admin-guide/cgroup-v2.html#memory- interface-files 6. Zswap https://docs.kernel.org/admin-guide/mm/zswap.html 7. pids controller https://docs.kernel.org/admin-guide/cgroup-v2.html#pid 8. IO Interface Files https://docs.kernel.org/admin-guide/cgroup-v2.html#io-interface- files 9. NFT https://netfilter.org/projects/nftables/index.html 10. bpf.h https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/plain/include/uapi/linux/bpf.h 11. BPF documentation https://docs.kernel.org/bpf 12. Control Group APIs and Delegation https://systemd.io/CGROUP_DELEGATION 13. Memory Pressure Handling in systemd https://systemd.io/MEMORY_PRESSURE 14. Control Groups version 1 https://docs.kernel.org/admin-guide/cgroup-v1/index.html systemd 257.13 SYSTEMD.RESOURCE-CONTROL(5)