利用LXCFS增强docker容器隔离性和资源可见性

image

---

基于LXCFS增强docker容器隔离性的分析
https://blog.csdn.net/s1234567_89/article/details/50722915

Kubernetes之路 2 - 利用LXCFS提升容器资源可见性
https://yq.aliyun.com/articles/566208

---

1. install lxcfs and start

wget https://copr-be.cloud.fedoraproject.org/results/ganto/lxd/epel-7-x86_64/00486278-lxcfs/lxcfs-2.0.5-3.el7.centos.x86_64.rpm
yum install -y lxcfs-2.0.5-3.el7.centos.x86_64.rpm 

lxcfs /var/lib/lxcfs &  

2. check memory in container

docker run --rm -it -m 256m \
      -v /var/lib/lxcfs/proc/cpuinfo:/proc/cpuinfo:rw \
      -v /var/lib/lxcfs/proc/diskstats:/proc/diskstats:rw \
      -v /var/lib/lxcfs/proc/meminfo:/proc/meminfo:rw \
      -v /var/lib/lxcfs/proc/stat:/proc/stat:rw \
      -v /var/lib/lxcfs/proc/swaps:/proc/swaps:rw \
      -v /var/lib/lxcfs/proc/uptime:/proc/uptime:rw \
      ubuntu:16.04 free -h

3.deploy in k8s cluster

git clone https://github.com/denverdino/lxcfs-initializer
cd lxcfs-initializer

kubectl apply -f lxcfs-daemonset.yaml
kubectl apply -f lxcfs-initializer.yaml

---

参考 cgroup
https://blog.csdn.net/horsefoot/article/details/51731543
https://www.cnblogs.com/sammyliu/p/5886833.html