Question
Container Resource Limit Enforcement in Portainer CE
Kavi Maple
0 reputation · 20 May 2024, 02:05 UTC
45.3K views
Loading…
0 reputation · 20 May 2024, 02:05 UTC
Portainer CE allows users to define CPU shares, memory limits, and memory reservations through the 'Resources' section during container creation or editing. This interface abstracts the underlying Docker Engine API to prevent individual containers from consuming all available host memory or processing power.
The availability of these controls depends on the endpoint type. While standard Docker environments support these fields, the UI behavior changes when connected to different orchestrators or specific environment configurations where the underlying API does not support these specific resource flags.
There is uncertainty regarding how Portainer handles the persistence of these limits when a container is updated via the UI versus when the underlying image is updated through a pull-and-redeploy action.
35775 reputation · 20 May 2024, 02:35 UTC
1. Do the "Resources" settings persist when a container is manually updated via the image pull?
docker
portainerHostConfig values that were stored when the container was first created or last edited. Therefore, the CPU shares, memory limit and reservation you set in the UI are re‑applied automatically during a manual image pull and redeploy.2. How does Portainer validate the memory limit against the host’s available RAM?
HostConfig field Memory. The Docker daemon, backed by cgroups, decides whether the limit is acceptable. If the limit exceeds the host’s capacity or violates Docker’s minimum thresholds, the container creation fails with a Docker error.docker inspect --format '{{json .HostConfig}}' <container‑id>docker inspect --format '{{json .HostConfig}}' <new‑container‑id>Memory, MemoryReservation, and CpuShares fields. They should match the values you originally set.Memory: 64g on an 8 GB machine). Docker will refuse to start the container, producing an error such as Cannot set memory limit: insufficient memory.To give you the most accurate guidance, could you confirm:
With those details, we can refine the steps or recommend adding resource limits directly to your Compose file if you rely on stack redeployments.
Use comments to ask for clarification. Post a solution as an answer.
35,775 reputation · 20 May 2024, 09:24 UTC
While Portainer CE correctly passes resource limits to the Docker Engine API, it is important to note that actual enforcement depends entirely on the host kernel's cgroups (control groups) configuration. If the underlying Linux distribution has memory cgroup support disabled—which is common in some minimal or older kernel configurations—the memory limits set in the Portainer UI will be ignored by the engine without triggering a deployment error.
To confirm that limits are being actively enforced rather than just stored in the configuration, you can use the following approach:
docker stats while the container is under load to observe if memory usage caps at the defined limit./sys/fs/cgroup/memory) to ensure the memory controller is active.