Setting resource limits on rootless containers
A few moments ago, I told you about the concept of delegation. Normally, you need root privileges in order to set any resource limits. However, you can delegate this chore to non-privileged users. The best news is that unlike delegation under cgroups Version 1, delegation under cgroup Version 2 is perfectly safe.
To see the default setting, open the /lib/systemd/system/[email protected] file, and look for the Delegate= line in the [Service] section. The applicable lines should look like this:
[Service] . . . . . . Delegate=pids memory . . . . . .
By default, Fedora only allows non-privileged users to set resource limits for memory and for the maximum number of running processes. We need to edit that to include the cpu, cpuset, and io resource controllers, like this:
[donnie@fedora ~]$ sudo systemctl edit --full [email protected]
Edit the Delegate= line so that it will look like this:
Delegate=pids memory io cpu cpuset
Save...