Linux cgroups: limit CPU usage in absolute values which do not depend on CPU speed

Question

I have a server with a 2.4GHz processor. And there are several cgroups, each one allowed to use 25% of CPU. That's equal to 600MHz.

Then I replace the CPU with a faster one, let's say 3.0GHz. If I use cpu.shares, my containers will continue to get 25% of 3.0GHz which is now equal to 750MHz.

That means that after CPU replacement I have to reconfigure my cgroups to make them consume not more than 20% of CPU.

Is there a way to avoid this trouble during a CPU upgrade?

Solution

Shares are relative among groups. For example, assigning 25% of CPU means that a cgroup will observe "at least" that much of CPU, but it can use more. From the red hat docs on cgroups:

Note that shares of CPU time are distributed per all CPU cores on multi-core systems. Even if a cgroup is limited to less than 100% of CPU on a multi-core system, it may use 100% of each individual CPU core.

...

The actual amount of CPU time that is available to a cgroup can vary depending on the number of cgroups that exist on the system. If a cgroup has a relative share of 1000 and two other cgroups have a relative share of 500, the first cgroup receives 50% of all CPU time in cases when processes in all cgroups attempt to use 100% of the CPU. However, if another cgroup is added with a relative share of 1000, the first cgroup is only allowed 33% of the CPU (the rest of the cgroups receive 16.5%, 16.5%, and 33% of CPU).

If you want a hard limit on CPU bandwidth, you can use cpu.cfs_quota_us and cpu.cfs_period_us. From the Kernel's CFS docs:

The bandwidth allowed for a group is specified using a quota and period. Within each given "period" (microseconds), a group is allowed to consume only up to "quota" microseconds of CPU time. When the CPU bandwidth consumption of a group exceeds this limit (for that period), the tasks belonging to its hierarchy will be throttled and are not allowed to run again until the next period.

However, neither of these two options will allow you to port a group between distinct CPUs without having to change the cgroups configuration.