Re: jail process limits

On Thu, May 22, 2008 at 03:26:13PM -0400, Vivek Khera wrote:
While we're on the topic of jail resource limits, I think I'll ask my
question again... I asked last month but got no response...


I've got a jail server (FreeBSD 6.3/amd64) which runs a bunch of web
site development environments. There is an apache or lighttpd running
in each jail as user httpd (same UID on base system and each jail).

On the jail host, I counted 231 processes owned by httpd.

If I try to start an application server (or any process) as user httpd
in one of the jails, it exits immediately with "Cannot fork: Resource
temporarily unavailable". Even if I "su httpd" I get the same error
on any command I try to run such as "ls". If I run the same on the
jail host, it has no problems. The jail itself only has 34 processes
running.

On the jail host, the following is logged:

Apr 22 16:34:38 staging kernel: maxproc limit exceeded by uid 80,
please see tuning(7) and login.conf(5).

Can anyone tell me where to look to find out what is limiting user
httpd from creating new processes inside the jail, and what exactly
that limit is? More importantly, how to increase it.

I'd start by instrumenting the code path that leads to the above
kernel printf, to try and differentiate any possible causes.

Kris

--
In God we Trust -- all others must submit an X.509 certificate.
-- Charles Forsythe <forsythe@xxxxxxxxxxxx>
_______________________________________________
freebsd-stable@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: jail: socket unavaible [ being resovled...need help any way]
    ... Try making sure all your HTTPd instances on the system bind to a specific IP. ... Sounds to me like you have another web server bound to * outside the jail? ... To unsubscribe, ... there's any other daemon on apache/ssl's port on system. ...
    (freebsd-stable)
  • more than 1 IP in jail
    ... if I got the docs right, I can not bind more than one IP to a jail. ... Is there any way to operate a httpd inside a jail with IP-Based virtual hosts? ... Wieviele Mitarbeiter von Microsoft benoetigt man fuer das auswechseln ...
    (FreeBSD-Security)
  • Re: jails available in openbsd?
    ... >> Are you refering to chroot environments? ... I know that named and httpd are ... >> installed by default and run within a chroot jail. ... > Altough you could call a chroot a jail, ...
    (comp.unix.bsd.openbsd.misc)
  • Re: [Jail] Setting default route in Jail?
    ... >> hosts default route. ... >> default route in the jail environment to the IP address of my jail host ... >> and enable the jail host as a gateway. ... > ipfw rules and set up natd but I don't remember exactly what it was I ...
    (freebsd-questions)
  • Re: unprivileged users are able to kill certain jailed processes
    ... Well, the host admin, when detailing services and responsibilities to the jail admin, can tell the jail admin which range of UIDs to use for new users. ... It is ONLY accessible through certificate protected ssh and no services run on the jail server itself, only services in jails, so the only open port on the jail server itself is the sshd one... ...
    (freebsd-current)