I'd like to limit the number of pids a container can consume on RHEL 8.3 to provide protection against things like bash fork bombs.  Ideally I would want to do this in a rootless container but when I do $ podman run -it -u user1 --pids-limit 42 frog I get: Error: container_linux.go:370: starting container process caused: process_linux.go:459: container init caused: process_linux.go:422: setting cgroup config for procHooks process caused: cannot set pids limit: container could not join or create cgroup: OCI runtime error I can however run the same podman command as root without issue. Is there a method to do this as non root?  Or a better solution using systemd? Thanks, Ed -- Ed Haynes SOLUTIONS ARCHITECT Red Hat <https://www.redhat.com/> ehaynes(a)redhat.com <mailto:ehaynes@redhat.com> *M: (978)-551-0057 * TRIED. TESTED. TRUSTED. _______________________________________________ Podman mailing list -- podman(a)lists.podman.io To unsubscribe send an email to podman-leave(a)lists.podman.io

I did try setting cgroups v2 in the grub bootline for 8.3 but then podman dies with a separate error Error:  Default OCI runtime "crun" not found: invalid argument

On Wed, Mar 24, 2021 at 3:14 PM Daniel Walsh <dwalsh(a)redhat.com <mailto:dwalsh@redhat.com>> wrote: Rootless pids-limit requires cgroups V2. We probably should add info to the man page. On 3/24/21 10:36, Ed Haynes wrote: > I'd like to limit the number of pids a container can consume on > RHEL 8.3 to provide protection against things like bash fork > bombs.  Ideally I would want to do this in a rootless container > but when I do > > $ podman run -it -u user1 --pids-limit 42 frog > > I get: > > Error: container_linux.go:370: starting container process caused: > process_linux.go:459: container init caused: > process_linux.go:422: setting cgroup config for procHooks process > caused: cannot set pids limit: container could not join or create > cgroup: OCI runtime error > > I can however run the same podman command as root without issue. > > Is there a method to do this as non root?  Or a better solution > using systemd? > > Thanks, Ed > > -- > Ed Haynes > > SOLUTIONS ARCHITECT > > Red Hat <https://www.redhat.com/> > > ehaynes(a)redhat.com <mailto:ehaynes@redhat.com> *M: (978)-551-0057 * > > > TRIED. TESTED. TRUSTED. > > _______________________________________________ > Podman mailing list --podman(a)lists.podman.io <mailto:podman@lists.podman.io> > To unsubscribe send an email topodman-leave(a)lists.podman.io <mailto:podman-leave@lists.podman.io> _______________________________________________ Podman mailing list -- podman(a)lists.podman.io <mailto:podman@lists.podman.io> To unsubscribe send an email to podman-leave(a)lists.podman.io <mailto:podman-leave@lists.podman.io> -- Ed Haynes SOLUTIONS ARCHITECT Red Hat <https://www.redhat.com/> ehaynes(a)redhat.com <mailto:ehaynes@redhat.com> *M: (978)-551-0057 * TRIED. TESTED. TRUSTED. _______________________________________________ Podman mailing list -- podman(a)lists.podman.io To unsubscribe send an email to podman-leave(a)lists.podman.io