Linux system restricts user resources through the ulimit command to prevent excessive use of resources. 1. Ulimit is a built-in shell command that can limit the number of file descriptors (-n), memory size (-v), thread count (-u), etc., which are divided into soft limit (current effective value) and hard limit (maximum upper limit). 2. Temporary modifications use the ulimit command directly, such as ulimit -n 2048, but it is only valid for the current session. 3. For permanent effect, modify /etc/security/limits.conf and PAM configuration files, and add session required pam_limits.so. 4. The systemd service needs to set parameters such as LimitNOFILE, LimitNPROC in the unit file, and overload systemd takes effect.

The Linux system restricts user resources, mainly through the mechanism provided by the kernel to control the process's use of system resources. Among them, ulimit is a commonly used command line tool to set or view resource restrictions under the current shell session. It is suitable for preventing a user or program from occupying too much resources, such as memory, CPU time, number of opened files, etc.

Here are some common configuration methods and precautions:

1. What is ulimit? What resources can be limited?

ulimit is a built-in command in Linux shell to control the usage limit of system resources. What it may limit includes but is not limited to:

• Maximum number of open file descriptors ( -n )
• The maximum memory size that a single process can use ( -v )
• Maximum number of threads ( -u )
• CPU time ( -t )
• Stack space size ( -s )

These limitations are divided into soft limit and hard limit :

• The soft limit is the value that you are currently in effect. Ordinary users can only adjust to a value that does not exceed the hard limit.
• The hard limit is set by root and cannot be exceeded by ordinary users.

For example, to view the resource limits of the current user, you can use:

 ulimit -a

2. How to temporarily modify ulimit settings?

If you just want to temporarily modify certain restrictions in the current terminal session, you can use the ulimit command directly. For example:

 ulimit -n 2048 # Set the number of open files to 2048
ulimit -u 1024 # Set up to 1024 processes per user

Note that this modification is only valid in the current shell session, and will be invalid after restarting or opening a new terminal.

In addition, some restrictions can only be raised to the range of hard restrictions. If you need to break through hard restrictions, you have to use root permissions to modify them.

3. How to take effect permanently? How to change the configuration file?

To make the ulimit setting take effect every time you log in, you need to modify the system configuration file.

There are mainly two documents:

• /etc/security/limits.conf
• /etc/pam.d/common-session (Debian system) or /etc/pam.d/login (RedHat system)

Add something like this in limits.conf :

 * soft nofile 4096
* hard nofile 8192
www-data soft nproc 2048
www-data hard nproc 4096

This means that the soft limit for all users ( * ) is 4096 file descriptors, and the hard limit is 8192; and the process limit for www-data users is also set.

In addition, make sure that the PAM module is loaded with pam_limits.so and add it to /etc/pam.d/common-session :

 session required pam_limits.so

In this way, the system will apply the ulimit rules you set every time the user logs in.

4. How to set resource restrictions for systemd service?

If you are using a service managed through systemd, such as nginx, redis, and custom scripts, you cannot rely on limits.conf , because the systemd service does not follow the PAM process.

At this time, resource restrictions should be set in the service unit file. For example, add in /etc/systemd/system/myapp.service :

 [Service]
LimitNOFILE=8192
LimitNPROC=4096

Then reload systemd and restart the service:

 systemctl daemon-reexec
systemctl restart myapp

This will allow you to control the resource limit of a certain service individually.

Basically that's it. Ulimit looks simple, but pay attention to the way it takes effect and scope of action. Sometimes you set it but it doesn't take effect, it may be because the service does not go through the PAM process or is overwritten by systemd. When encountering problems, remember to check the logs, or use the prlimit command to view the actual limitations of the specific process.

The above is the detailed content of How to limit user resources in Linux? How to configure ulimit?. For more information, please follow other related articles on the PHP Chinese website!