How can a Docker container tell whether its memory was limited?

Question

I'm using cgget -n --values-only --variable memory.limit_in_bytes / inside a Docker container to see how much memory it is allowed to use as per docker run --memory=X. However, I need to know whether the memory was limited at all, which isn't answered by the command above because it'd just give me a large number in that case (9223372036854771712 in my tests).

So, is there any way to tell whether memory was limited at all? I'm looking for solutions that don't involve running docker run in a special way, like mounting files from the host (e.g., /var/...) or passing an environment variable.

Alternator

See here: #42187585 – Jailbreak

Answer 1

You could compare the total physical memory available to the number cgget gives you. If the number given by cgget is lower than the total physical memory, then you know for sure cgroups where used to limit the memory.

For instance if I run a container limiting the memory to 100M on my computer which has 2G of physical memory, cgget will report 104857600 while the free command reports 2098950144 bytes:

On the docker host :

# free -b
             total       used       free     shared    buffers     cached
Mem:    2098950144  585707520 1513242624     712704   60579840  367644672
-/+ buffers/cache:  157483008 1941467136
Swap:   3137335296          0 3137335296    

Start a container limited to 100M

docker run --rm -it --memory=100M <any-image-with-cgget-available> bash -l

Now within that container:

# free -b
             total       used       free     shared    buffers     cached
Mem:    2098950144  585707520 1513242624     712704   60579840  367644672
-/+ buffers/cache:  157483008 1941467136
Swap:   3137335296          0 3137335296    

# cgget -n --values-only --variable memory.limit_in_bytes /
104857600

Note that the free command will report the same values on the docker host as from within the containers.

In the end, the following bash script defines a function is_memory_limited that can be used in a test to check if cgroup where used to limit the memory.

#!/bin/bash
set -eu

function is_memory_limited {
    type free >/dev/null 2>&1 || { echo >&2 "The 'free' command is not installed. Aborting."; exit 1; }
    type cgget >/dev/null 2>&1 || { echo >&2 "The 'cgget' command is not installed. Aborting."; exit 1; }
    type awk >/dev/null 2>&1 || { echo >&2 "The 'awk' command is not installed. Aborting."; exit 1; }

    local -ir PHYSICAL_MEM=$(free -m | awk 'NR==2{print$2}')
    local -ir CGROUP_MEM=$(cgget -n --values-only --variable memory.limit_in_bytes / | awk '{printf "%d", $1/1024/1024 }')

    if (($CGROUP_MEM <= $PHYSICAL_MEM)); then
        return 0
    else
        return 1
    fi
}


if is_memory_limited; then
    echo "memory is limited by cgroup"
else
    echo "memory is NOT limited by cgroup"
fi

Persuade

Well on my ubuntu 16, it read cgget command not found ; trying to install apt-get install cgget also failed. Please help! – Tortosa

Should anyone else search: they can be found in the cgroup-bin package – Greasepaint

@Greasepaint As of Ubunto 20 it's cgroup-tools. – Henleyonthames

When I run cgget -n --values-only --variable memory.limit_in_bytes / in my container (Ubuntu 20.04 running on macOS Docker Desktop 2.3.0.4 with --memory=1536m) I get ULONG_MAX (9223372036854771712). – Henleyonthames

Answer 2

Just my 2 cents, rather than installing any third-party tools, you can simply check the limited memory using docker stats

docker container run --name mytestserver -m 200M -dt nginx

As in this case, I limited the amount of memory to 200M, now to verify it

docker stats <container id>

CONTAINER ID        NAME                CPU %               MEM USAGE / LIMIT   MEM %               NET I/O             BLOCK I/O           PIDS
3afb4a8cfeb7        mytestserver        0.00%               **1.387MiB / 200MiB**   0.69%               8.48MB / 24.8kB     39.2MB / 8.25MB     2

Earleneearley

This doesn't answer the question "How can a Docker container tell whether its memory was limited?". The commands you're providing have to be used from the host machine. – Alternator