Docker实践—资源隔离和限制

构建stress镜像

[root@controller ~]# cd /home/shangwu/tools/
[root@controller tools]# cd dockerfile/
[root@controller dockerfile]# mkdir stress
[root@controller dockerfile]# cd stress/
[root@controller stress]# vim Dockerfile
[root@controller stress]# cat Dockerfile
From centos
ADD epel-7.repo /etc/yum.repos.d/
RUN yum install -y stress && yum clean all
ENTRYPOINT ["stress"]
[root@controller stress]#
[root@controller stress]# wget  http://mirrors.aliyun.com/repo/epel-7.repo [root@controller stress]# docker images
REPOSITORY             TAG                 IMAGE ID            CREATED             VIRTUAL SIZE
centos                 latest              72a210db1424        36 hours ago        192.5 MB
[root@controller stress]#
[root@controller stress]# docker build -t stress .
[root@controller stress]# docker images
REPOSITORY             TAG                 IMAGE ID            CREATED             VIRTUAL SIZE
stress                 latest              a458db7db05b        28 seconds ago      212.1 MB
centos                 latest              72a210db1424        36 hours ago        192.5 MB
lemonbar/centos6-ssh   latest              b78c71c001db        2 years ago         296.9 MB
[root@controller stress]#

查看docker run命令帮助输出

[root@controller stress]# docker run --help
-c, --cpu-shares=0          CPU shares (relative weight)
--cpuset-cpus=              CPUs in which to allow execution (0-3, 0,1)
-m, --memory=               Memory limit
[root@controller stress]#

CPU

启动一个容器:

[root@linux-node1 stress]# docker run  -it --rm --cpuset-cpus=0 stress --cpu 1stress: info: [1] dispatching hogs: 1 cpu, 0 io, 0 vm, 0 hdd

在另外一个窗口查看使用情况cpu

[root@controller ~]# toptop - 19:21:25 up 18:12,  3 users,  load average: 0.22, 0.05, 0.02Tasks: 244 total,   2 running, 242 sleeping,   0 stopped,   0 zombieCpu(s): 12.5%us,  0.0%sy,  0.0%ni, 87.5%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%stMem:   3917020k total,  3267980k used,   649040k free,    81992k buffersSwap:  4095996k total,        0k used,  4095996k free,  2872996k cachedPID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND15386 root      20   0  7204  128   28 R 100.0  0.0   0:15.85 stress36 root      20   0     0    0    0 S  0.3  0.0   0:08.21 events/11 root      20   0 19232 1376 1108 S  0.0  0.0   0:03.27 init2 root      20   0     0    0    0 S  0.0  0.0   0:00.22 kthreadd     

同样，再开启一个窗口:

[root@controller ~]# docker run  -it --rm --cpuset-cpus=0 -c 512 stress --cpu 1

再查切换到其他窗口查看cpu使用情况

[root@controller ~]# toptop - 19:23:58 up 18:15,  3 users,  load average: 1.09, 0.45, 0.17Tasks: 251 total,   3 running, 248 sleeping,   0 stopped,   0 zombieCpu(s): 12.5%us,  0.0%sy,  0.0%ni, 87.5%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%stMem:   3917020k total,  3280344k used,   636676k free,    82764k buffersSwap:  4095996k total,        0k used,  4095996k free,  2876432k cachedPID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND15386 root      20   0  7204  128   28 R 66.5  0.0   2:45.48 stress15489 root      20   0  7204  124   28 R 33.2  0.0   0:03.80 stress1 root      20   0 19232 1376 1108 S  0.0  0.0   0:03.27 init2 root      20   0     0    0    0 S  0.0  0.0   0:00.22 kthreadd

注意命令

docker run  -it --rm stress --cpu 1docker run  -it --rm --cpuset-cpus=0 stress --cpu 1--cpuset-cpus后面跟cpu总个数，为docker容器指定的，而--cpu是用多少个cpu来运行，只能是1、2、3、4 ...N等等-c可以指定CPU的占比;--cpuset可以绑定CPU;

内存

概述

Docker提供参数-m, --memory=""限制容器的内存使用量。

情况1-正常

[root@controller ~]# docker run -it --rm -m 128m stress --vm 1 --vm-bytes 128M --vm-hang 0stress: info: [1] dispatching hogs: 0 cpu, 0 io, 1 vm, 0 hdd

情况2-正常

[root@controller ~]# docker run -it --rm -m 128m stress --vm 1 --vm-bytes 200M --vm-hang 0stress: info: [1] dispatching hogs: 0 cpu, 0 io, 1 vm, 0 hdd

情况3-异常

[root@controller ~]# docker run -it --rm -m 128m stress --vm 1 --vm-bytes 260M --vm-hang 0stress: info: [1] dispatching hogs: 0 cpu, 0 io, 1 vm, 0 hddstress: FAIL: [1] (415) <-- worker 6 got signal 9stress: WARN: [1] (417) now reaping child worker processesstress: FAIL: [1] (421) kill error: No such processstress: FAIL: [1] (451) failed run completed in 4s[root@controller ~]# 

IO（参考）

# docker run -it --rm dbyin/tlinux:1.2 /bin/bashbash-4.1# time $(dd if=/dev/zero of=f1.txt bs=1024 count=500000 && sync)500000+0 records in500000+0 records out512000000 bytes (512 MB) copied, 1.28334 s, 399 MB/sreal    0m12.091suser    0m0.056ssys     0m1.237s可以看到，写512M数据，共用12s，平均42M/s。将IO带宽限制为10M/s：# echo "253:1 10485760" > /cgroup/blkio/docker/$CONTAINER_ID/ blkio.throttle.write_bps_devicebash-4.1# time $(dd if=/dev/zero of=f1.txt bs=1024 count=500000 && sync)500000+0 records in500000+0 records out512000000 bytes (512 MB) copied, 1.41813 s, 361 MB/sreal    0m50.348suser    0m0.071ssys     0m1.473s