controlling priority of applications using cgroups

Question

I would like to understand cgroups better and would like to understand the use-cases for applying cgroups.

Are cgroups a good way for prioritizing different applications (i.e, giving higher priority to specific types of applications like web servers)?

Solution

There are several uses for cgroups. From the system administration probably the most important one is limiting resources -- the classical example here being the cpu access. If you create a group for e.g. sshd and give it some non-negligible CPU time share (compared to other groups or the default under which fall all unsorted processes), you are guaranteed to being able to login even in times when the machine will be running a CPU-intensive tasks.

More interestingly, if you give this "remote access" processes much higher CPU share then the rest, you will be able to log in almost instantly (because the ssh daemon will be prioritised over the rest of running processes) while you won't hurt the overall computation strength of the machine, since the resources are allocated only on a per-need basis. You usually want to do this together with I/O (including network) prioritisation. However, as John correctly points out in the comment below, one doesn't want to do these things carelessly (since it might fire back in an unexpected way). Important thing to bear in mind is that the groups are inherited by default -- i.e. one doesn't want to start a memory/CPU hog from such an ssh session. Yet for this there are mechanisms that can assign processes to cgroups as they start.

Another use is isolating the processes from each other -- in combination with other features (namespace isolation) in recent Linux kernels they are used to create OS-level virtualization like the LXC (Linux Containers).

Other than that you can do various accounting and control stuff (freezing some processes groups, assigning them to specific CPU cores etc.).

The two links here, should be a reasonable starting place if you are looking for more information. You may also want to check Documentation/cgroups directory in the Linux kernel source tree.

Comments

[Admin]

CPU throttling is a good use case for cgroups: kennystechtalk.blogspot.co.uk/2015_04_01_archive.html

[Johnnie]

thank you. the sshd example is interesting and brings up another related thought. one aspect i hadn't considered is ensuring other resources are allocated appropriately - i'm assuming that someone with incomplete knowledge of the profile of an application can wreak havoc by only allocating resources for CPU (in this example) and no allocation for I/O (say network). If so - are there well known profiles for cgroups published anywhere?

[peterph]

@John interesting question indeed. You might want to check distributions which have systemd, which (ab)uses cgroups for its own purposes - the systemd unit files for services might give some clues about what might be reasonable. But in the end it's always up to the system administrator to learn the hard way, what really is not the "Good Idea (TM)".

[kokbira]

Where and how to create those groups?

[peterph]

@kokbira depends on what level - generally you write into the cgroup pseudofilesystem that you may need to mount first. In most cases today, the init system does that for you and often uses cgroups in some way already. The only definitive answer is read the documentation: kernel docs, OpenRC@Gentoo, systemd@freedesktop.

[kokbira]

@peterph, thanks a lot. My aim is simply to reduce priority of Firefox and its children, once it is a RAM-hungry that often freezes my system :/ - I do not understand why does an operational system give such power to an ordinary app to destroy its execution :)

[peterph]

@kokbira the operating system does what you tell it to (at least a good one - there are some that do a lot other things which you don't tell them to, but that's another story). The idea is, that if you run an application you want it to get whatever it needs to perform whatever you expect it to. If the application misbehaves it is up to the system operator (which happens to be you in this case) to do something about it. The distribution authors could come up with some heurestics how to catch this kind of problems, but it would cause more problems that it would fix.

[peterph]

@kokbira as for Firefox itself, I would suggest using some addons that decrease load put on the browser and the consequently the whole system. From my experience NoScript & uBlock origin are enough. Especially NoScript in the "block everything by default" does wonders - just enable the bare minimum you need to work with the websites you are using and you can easily get to hundred of tabs on a 8GB RAM system and still work pretty well. Plus you have the additional level of protection from all the JS rubbish most websites use these days for unnecessary fancy effects.