How to limit the resource usage of AIO?

[szaimen]

In some cases, you might want to limit the overall resource usage of AIO.

You can do so by configuring the docker daemon like shown below.

1. Create a Custom Systemd Slice

Create a new systemd slice file to define your global resource limits.
Create a file named /etc/systemd/system/docker_limit.slice.
Add the desired resource constraints to this file.

[Unit]
Description=Slice that limits docker resources
Before=slices.target

[Slice]
# Memory Management
MemoryAccounting=true
MemoryMax=8G
# CPU Management
CPUAccounting=true
CPUQuota=400%

Explanation of parameters:
MemoryMax: The maximum amount of RAM the Docker daemon and all its containers can use collectively (e.g., 8G).
CPUQuota: The maximum CPU usage as a percentage of a single core. 400% means a limit equivalent to 4 CPU cores.

2. Start the New Slice

Apply the new slice configuration immediately:

sudo systemctl start docker_limit.slice

3. Configure the Docker Daemon

Edit the Docker daemon configuration file (usually stored in /etc/docker/daemon.json) to instruct the daemon to use the newly created cgroup-parent.

{
  "cgroup-parent": "docker_limit.slice"
}

If the file does not exist, create it. If it already contains other settings, add the cgroup-parent line, ensuring valid JSON format (commas between entries).

4. Restart the Docker Daemon

For the changes to take effect, restart the Docker service:

sudo systemctl daemon-reload
sudo systemctl restart docker

Verification

After restarting, you can verify the limits by running containers and monitoring total system resource usage via standard Linux tools (like top, htop, or systemd-cgtop), or by using docker stats which will show the containers running within the imposed limits. The total memory available to all containers combined should not exceed the MemoryMax you set.

Alternative for Docker Desktop Users (Windows/macOS)

If you are using Docker Desktop on Windows or macOS, you do not use systemd slices. Instead, the Docker daemon runs inside a hidden Virtual Machine (VM). You can configure the VM's resource limits via the Docker Desktop GUI settings or the .wslconfig file for WSL2 on Windows.

[philiprenich]

Thanks @szaimen , this is really useful info. This will affect all containers I run, not just AIO ones? I don't think I need fine-grained controls over individual containers for the problem I'm trying to solve (server being unresponsive), so this should be fine.

[philiprenich]

FYI, I had to drop the prefixed / in the cgroup_parent value in daemon.json. That could potentially be problematic so I'll monitor how things go.

[szaimen]

Ok, shall I afjust the guide accordingly?

[philiprenich]

Unfortunately, I’m not familiar enough with systemd or the inner workings of Docker to know which is best. I mainly wanted to note it here for anyone else who might get an error.