Stage 4 · Provision
Production Containers
Resource Limits
Set CPU and memory limits, understand OOM kills, cgroup metrics, and application tuning.
Why Resource Limits?
Without resource limits, a single container can consume all available CPU and memory on a host, starving other containers and potentially crashing the host. Every production container should have explicit CPU and memory limits to ensure fair resource sharing and prevent cascading failures.
Memory Limits
# Limit to 512MB
docker run --memory=512m myapp
# Limit memory with no swap
docker run --memory=512m --memory-swap=512m myapp
# Limit memory with some swap
docker run --memory=512m --memory-swap=1g myapp
# Set memory reservation (soft limit)
docker run --memory=512m --memory-reservation=256m myappThe --memory flag sets a hard limit. The kernel kills the container if it exceeds this. --memory-reservation sets a soft limit that the kernel tries to enforce when memory is scarce.
CPU Limits
# Limit to 2 CPU cores
docker run --cpus=2 myapp
# Limit to 50% of one CPU
docker run --cpus=0.5 myapp
# CPU shares (relative weight)
docker run --cpu-shares=512 myapp # Half default
docker run --cpu-shares=2048 myapp # Double default
# Pin to specific CPUs
docker run --cpuset-cpus="0,1" myapp
# Combine CPU and memory
docker run --cpus=2 --memory=1g myapp--cpus is a hard cap. --cpu-shares only matters when multiple containers compete for CPU. --cpuset-cpus pins to specific cores, useful for NUMA-aware applications.
OOM Kills
When a container exceeds its memory limit, the Linux OOM (Out of Memory) killer terminates its processes. The container's state shows OOMKilled: true. Understanding OOM kills helps you set appropriate memory limits.
# Check if a container was OOM killed
docker inspect --format '{{.State.OOMKilled}}' mycontainer
# View container memory usage
docker stats mycontainer --no-stream
# Check dmesg for OOM events
dmesg | grep -i oom
# Set appropriate limits to prevent OOM
docker run --memory=1g --memory-swap=1g myapp
# Disable OOM kill (dangerous — can destabilize host)
docker run --memory=1g --oom-kill-disable myappOOM kills happen instantly with no warning. The container restarts if its restart policy allows. Monitor memory usage and set limits that match your application's actual needs.
Disabling OOM kill means an unbounded container can consume all host memory, potentially crashing the entire host and all containers on it. Only use --oom-kill-disable for testing.
Monitoring Usage
# Real-time resource usage
docker stats
# Format specific metrics
docker stats --format "table {{.Name}} {{.CPUPerc}} {{.MemUsage}} {{.NetIO}}"
# Snapshot for scripting
docker stats --no-stream --format "{{.Name}}: CPU={{.CPUPerc}} MEM={{.MemUsage}}"
# Check container resource configuration
docker inspect --format '{{.HostConfig.Memory}}' mycontainer
docker inspect --format '{{.HostConfig.NanoCpus}}' mycontainerdocker stats shows real-time CPU, memory, network, and I/O usage. Use it to validate that your limits are appropriate. A container using 400MB should have a 512MB limit, not unlimited.
Right-Sizing Containers
Right-sizing means setting resource limits that match your application's actual needs. Too low causes OOM kills and throttling. Too high wastes resources and reduces density. Start with generous limits, monitor usage, and adjust.
# 1. Run without limits and monitor
docker run -d --name myapp myapp:latest
docker stats myapp --no-stream # Watch for 24-48 hours
# 2. Check peak memory usage
docker stats --no-stream --format "{{.MemUsage}}" myapp
# 3. Set limit to 1.5x peak usage
docker run -d --memory=768m --cpus=1.5 myapp:latest
# 4. Verify the limit is sufficient
docker stats myapp --no-streamSet memory limits to 1.5x the observed peak. Set CPU limits based on response time requirements. Monitor after setting limits to ensure they are sufficient.
Run your application under load for 24-48 hours with docker stats logging. This gives you peak and average resource usage. Use these numbers to set production limits.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.