I am trying to change net.core.somaxconn
for docker container to be able to have larger queue of requests for my web application.
On OS, outside docker, I first modify the property successfully:
$ cat /proc/sys/net/core/somaxconn
128
$ sudo sysctl -w net.core.somaxconn=1024
net.core.somaxconn = 1024
$ cat /proc/sys/net/core/somaxconn
1024
But then I don't know how to propagate that change into docker. I've tried:
- Also editing
/etc/sysctl.conf
(in hope of docker reading that file on container launch) - Restarting containers
sudo docker stop
andsudo docker run
again - Restarting the whole docker service by
sudo service docker restart
But inside container, cat /proc/sys/net/core/somaxconn
always shows 128
.
I'm running docker 1.2 (so I cannot, by default, modify /proc
attributes inside container) and in Elastic Beanstalk (so without --privileged
mode, that would allow me to modify /proc
).
How can I propagate the sysctl changes to docker?
The "net/core" subsys is registered per network namespace. And the initial value for somaxconn is set to 128.
When you do sysctl on the host system it sets the core parameters for its network namespace, which is the one owned by init. (basically this is the default namespace). This does not affect other network namespaces.
When a Docker container is started, the virtual network interface (shows up as vethXXX on the host) of that container is attached to its own namespace, which still has the initial somaxconn value of 128. So technically, you cannot propogate this value into the container, since the two network namespaces do not share it.
There are, however, two ways you can adjust this value, in addition to run the container in privileged mode.
use "--net host" when running the container, so it uses the host's network interface and hence share the same network namespace.
you can mount the proc file system as read-write using Docker's volume mapping support. the trick is to map it to a volume NOT named "/proc", since Docker will remount /proc/sys, among others, as read-only for non-privileged containers. This requires the host to mount /proc as rw, which is the case on most systems.
Method 2 should work on Elastic Beanstalk via its volume mapping support in Dockerrun.aws.json. Also it should work for other tunable parameters under /proc that's per-namespace. But this is most likely an oversight on Docker's part so they may add additional validation on volume mapping and this trick won't work then.
Just figured out how to solve this, now Elastic Beanstalk supports running a privileged containers and you just need to add the
"privileged": "true"
to yourDockerrun.aws.json
as the following sample (please take a look at thecontainer-1
):Please note that I duplicated this answer from another thread.
Update: This answer is obsolete as Docker now supports the
docker run --sysctl
option!The solution I use for my OpenVPN container is to enter the container namespace with full capabilities using
nsenter
, remounting/proc/sys
read-write temporarily, setting stuff up and remounting it read-only again.Here an example, enabling IPv6 forwarding in the container:
This way the container does not need to run privileged.
I found a solution:
more details here: /opt/elasticbeanstalk/hooks/appdeploy/pre/04run.sh
Update:
Add file
.ebextensions/02-commands.config
In docker 3.1 there is support for specifying sysctl. note the
sysctls:
- net.core.somaxconn=1024
My example docker-compose file
docker 1.12 add support for setting sysctls with --sysctl.
docs: https://docs.docker.com/engine/reference/commandline/run/#/configure-namespaced-kernel-parameters-sysctls-at-runtime