[SOLVED] Debian 11 - Bullseye : How to use and start cgroup to limit the chromium browser's CPU load to %25?

[hopperman]

I am trying to use cgroups in Debian 1 Bullseye.
1. Someone said me that, systemd takes control of cgroup-tools package after Debian 10, so in Debian 11. I checked it and it seems correct. But I do not know how to use systemd and it looks more complex than cgroups.
2. I searched the internet and find a way to create cgroup service to limit chromium's cpu limit in https://gist.github.com/jakewarren/477e ... 7a7c9abaa3. I modify the code given there to create a configuration file >> /etc/cgconfig.conf :

Code: Select all

group browsers {
	perm {
		task {
			uid = user;
			gid = user;
		}
		admin {
			uid = root;
			gid = root;
		}
	}
	cpu {
		# Allow chromium to use only %25 of the cpu
		cpu.shares = 250 ;
	}
	memory {
	# Allow chromium to use 256 MB ram maximum
		memory.limit_in_bytes = "256m";
	}
}

group important {
	perm {
		task {
			uid = user;
			gid = user;
		}
		admin {
			uid = root;
			gid = root;
		}
	}
	cpu {
		# Allow other processes to use %75 of CPU
		cpu.shares = 750;
	}
	memory {
		# Allow chromium to use 512MB maximum
		memory.limit_in_bytes = "512m";
	}
}

mount {
	cpuacct = /sys/fs/cgroup/cpuacct;
	memory = /sys/fs/cgroup/memory;
	devices = /sys/fs/cgroup/devices;
	freezer = /sys/fs/cgroup/freezer;
	net_cls = /sys/fs/cgroup/net_cls;
	blkio = /sys/fs/cgroup/blkio;
	cpuset = /sys/fs/cgroup/cpuset;
	cpu = /sys/fs/cgroup/cpu;
}

In the above configuration file, I try to create two groups, one is for browsers I choose and the other is for all tasks except those.

Then I created file called "/etc/cgrules.conf" to define a process (i.e. chromium browser executable file) for browsers group for "user:user" :

Code: Select all

# user:process 	subsystems	group
user:/usr/bin/chromium %U --incognito	cpu,cpuset,cpuacct	browsers

Then I create a service file named "/etc/systemd/system/cgroup.service" including :

Code: Select all

[Unit]
Description=Load cgroup configs
After=default.target

[Service]
Type=forking
ExecStartPre=/bin/echo "Precessing /etc/cgconfig.cong..."
ExecStartPre=/usr/sbin/cgconfigparser -l /etc/cgconfig.conf
ExecStartPre=/bin/echo "Processing /etc/cgrules.conf file..."
ExecStart=/usr/sbin/cgrulesengd --logfile=/var/log/cgrulesengd.log
Restart=on-failure

[Install]
WantedBy=multi-user.target

I am not sure the value of After=defalut.target, maybe someone help me about it too.
In /etc/systemd/system/ folder, I changed the permission of the file by

Code: Select all

sudo chmod 777 cgroup.service 

Then I copy service to /lib/systemd/system folder too(maybe place is important at restart, but not worked).
Next, I tried to enable service by using

Code: Select all

sudo systemctl enable cgroup.service

It does not give any error. However, when I try to start service using

Code: Select all

 sudo systemctl start cgroup.service 

that gives the error :

Code: Select all

cgroups.service - Load cgroup configs
     Loaded: loaded (/etc/systemd/system/cgroups.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Sat 2021-10-30 18:47:04 GMT; 7min ago
        CPU: 6ms

Eki 30 18:47:04 debian systemd[1]: cgroups.service: Scheduled restart job, restart counter is at 5ms.
Eki 30 18:47:04 debian systemd[1]: Stopped Load cgroup configs.
Eki 30 18:47:04 debian systemd[1]: cgroups.service: Start request repeated too quickly.
Eki 30 18:47:04 debian systemd[1]: cgroups.service: Failed with result 'exit-code'.
Eki 30 18:47:04 debian systemd[1]: Failed to start Load cgroup configs.

Then I looked for the error details by using sudo systemctl satus cgroup.service, then it gives detail as :

Code: Select all

cgroups.service - Load cgroup configs
     Loaded: loaded (/etc/systemd/system/cgroups.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Sat 2021-10-30 19:15:53 GMT; 20min ago
    Process: 4638 ExecStartPre=/bin/echo Precessing /etc/cgconfig.cong... (code=exited, status=0/SUCCESS)
    Process: 4639 ExecStartPre=/usr/sbin/cgconfigparser -l /etc/cgconfig.conf (code=exited, status=101)
        CPU: 5ms

Eki 30 19:15:53 debian systemd[1]: cgroups.service: Scheduled restart job, restart counter is at 5.
Eki 30 19:15:53 debian systemd[1]: Stopped Load cgroup configs.
Eki 30 19:15:53 debian systemd[1]: cgroups.service: Start request repeated too quickly.
Eki 30 19:15:53 debian systemd[1]: cgroups.service: Failed with result 'exit-code'.
Eki 30 19:15:53 debian systemd[1]: Failed to start Load cgroup configs.

I want to see that what is the specific error cgconfigparser created, so I used :

Code: Select all

 sudo /usr/sbin/cgconfigparser -l /etc/cgconfig.conf

that gives :

Code: Select all

Error: cannot mount memory to /sys/fs/cgroup/memory: Device or resource busy
/usr/sbin/cgconfigparser; error loading /etc/cgconfig.conf: Cgroup mounting failed

What is wrong? What can I do to use cgroup in Debian 11? Or how can I use systemd to control groups and processes (such as limit chromium browser's cpu limit to %25) ?

[hopperman]

Ok, I had a reverse progress... which means that, I could not succeed in installing a new service. I found the release document of Debian 11 in https://www.debian.org/releases/bullsey ... tes.en.pdf. Section 2.2.4 says that :

2.2.4 Control groups v2
In bullseye, systemd defaults to using control groups v2 (cgroupv2), which provides a unified resourcecontrol hierarchy. Kernel commandline parameters are available to re-enable the legacy cgroups if
necessary; see the notes for OpenStack in Section 5.1.9 section.

and in 5.1.9 section it says :

5.1.9 OpenStack and cgroups v1
OpenStack Victoria (released in bullseye) requires cgroup v1 for block device QoS. Since bullseye also
changes to using cgroupv2 by default (see Section 2.2.4), the sysfs tree in /sys/fs/cgroup will not
include cgroup v1 features such as /sys/fs/cgroup/blkio, and as a result cgcreate -g blkio:foo will
fail. For OpenStack nodes running nova-compute or cinder-volume, it is strongly advised to add the
parameters systemd.unified_cgroup_hierarchy=false and systemd.legacy_systemd_cgroup_controller=false
to the kernel command line in order to override the default and restore the old cgroup hierarchy.

Therefore, v1 control group commands does not work. Systemd also some command changes such as CPUShares becomes CPUWeight etc. (https://www.freedesktop.org/software/sy ... ntrol.html). Therefore, I started looking how to control cgroups by using systemd, not using v1 cgroups commands.

The most instructive document I have found is https://access.redhat.com/documentation ... the-kernel.
1. You need PID(process ID) of the process (you can learn it by using pgrep "<process name>")
2. You need to activate controllers such as CPU from the inside of the files available in /sys/fs/cgroup folder folder.
3. You need to send/add at least two PID data to group and wola! You get instant result.

I have solved my problem by the help of Stephen Kitt in https://unix.stackexchange.com/question ... 463#675463 since I asked the same question there and he guide me to systemd.

By the way, I am prejusticed the systemd commands by saying "...they look more complex than cgroups...", but they are not actually. They are also easy to apply.

[wadih]

libcgroup has now been updated to support cgroupv2, including the usual tools cgconfigparser and cgrulesengd.

You will have to build them from source from there.

https://github.com/libcgroup/libcgroup/ ... s/tag/v2.0

The controller setting names might be different, make sure you use the cgroupv2 ones in the new world.

[hopperman]

Dear wadih, thanks to reply.

But I am very very new to cgroup world. Therefore, I wrote each step I followed upto now. My aim is that all people see what I did until now. I do not know how to rebuild libcgroup and others. If you help me with these I will be appreciated.
I had also another problem with cgroupv2 commands such that, when I used it please look my other cgroupv2 problem in viewtopic.php?f=5&t=150650. RealTime(RT) processes blocks access to cpu because they are not in root group! How can I resolve that problem too?

In short,if I can rebuilt libcgroup(by the help of you and others), does that solves my below problems too? If you know answers please ;
1. do you know how to apply cgroupv2 command to limit chromium web-browser's CPU load to 25%?
2. how can I resolve moving all realtime process to root cgroup?
Thanks.