systemdで管理しているserviceがopenできるfile descriptorの上限数を増やす

systemdのバージョン

# systemd --version
systemd 237

TL;DR

ServiceにLimitNOFILEを設定すると良い．他の特定のリソースについての制限もどうようにかけることが可能です．

ドキュメントは man systemd.exec で参照できます (ウェブ上はこれが正しいリソース？ http://man7.org/linux/man-pages/man5/systemd.exec.5.html)．

挙動の検証

現状確認

テストのためにfileを開きまくるperlのscript．ついでにprocのlimit (/proc/{PID}/limitsの中身) も出力する:

#!/usr/bin/env perl

use strict;
use warnings;
use feature qw/say/;

open my $fh, '<', "/proc/$$/limits";
say do { local $/; <$fh> };

my @fhs;
for (my $i = 0; $i <= 2000; $i++) {
    my $filename = "/tmp/test.${i}";
    open my $fh, ">", $filename or die "$filename: $!";
    push @fhs, $fh;
}

特に何も考えずにsystemdのservice fileを書いてみます．

[Unit]
Description=test

[Service]
Type=oneshot
WorkingDirectory=/tmp/test

ExecStart=/usr/bin/perl run.pl

[Install]
WantedBy=multi-user.target

で，実行してみます

Starting test...
Limit                     Soft Limit           Hard Limit           Units
Max cpu time              unlimited            unlimited            seconds
Max file size             unlimited            unlimited            bytes
Max data size             unlimited            unlimited            bytes
Max stack size            8388608              unlimited            bytes
Max core file size        0                    unlimited            bytes
Max resident set          unlimited            unlimited            bytes
Max processes             3841                 3841                 processes
Max open files            1024                 1048576              files
Max locked memory         16777216             16777216             bytes
Max address space         unlimited            unlimited            bytes
Max file locks            unlimited            unlimited            locks
Max pending signals       3841                 3841                 signals
Max msgqueue size         819200               819200               bytes
Max nice priority         0                    0
Max realtime priority     0                    0
Max realtime timeout      unlimited            unlimited            us

/tmp/test.1020: Too many open files at run.pl line 13, <$fh> line 1.
test.service: Main process exited, code=exited, status=24/n/a
test.service: Failed with result 'exit-code'.
Failed to start test.

Too many open filesで死にます．Max open filesは1024のようですね．ulimit -nで表示される現状のデフォの値っぽい．

LimitNOFILEを設定してみる

[Unit]
Description=test

[Service]
Type=oneshot
WorkingDirectory=/tmp/test

ExecStart=/usr/bin/perl run.pl

LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

LimitNOFILE=65536をserviceの設定に追加してみます．それでscriptを実行:

Starting test...
Limit                     Soft Limit           Hard Limit           Units
Max cpu time              unlimited            unlimited            seconds
Max file size             unlimited            unlimited            bytes
Max data size             unlimited            unlimited            bytes
Max stack size            8388608              unlimited            bytes
Max core file size        0                    unlimited            bytes
Max resident set          unlimited            unlimited            bytes
Max processes             3841                 3841                 processes
Max open files            65536                65536                files
Max locked memory         16777216             16777216             bytes
Max address space         unlimited            unlimited            bytes
Max file locks            unlimited            unlimited            locks
Max pending signals       3841                 3841                 signals
Max msgqueue size         819200               819200               bytes
Max nice priority         0                    0
Max realtime priority     0                    0
Max realtime timeout      unlimited            unlimited            us

Max open filesが65536になってますね．おかげで実行にも失敗しない！　良かった良かった．

Starting test...
Limit                     Soft Limit           Hard Limit           Units
Max cpu time              unlimited            unlimited            seconds
Max file size             unlimited            unlimited            bytes
Max data size             unlimited            unlimited            bytes
Max stack size            8388608              unlimited            bytes
Max core file size        0                    unlimited            bytes
Max resident set          unlimited            unlimited            bytes
Max processes             3841                 3841                 processes
Max open files            10                   10                   files
Max locked memory         16777216             16777216             bytes
Max address space         unlimited            unlimited            bytes
Max file locks            unlimited            unlimited            locks
Max pending signals       3841                 3841                 signals
Max msgqueue size         819200               819200               bytes
Max nice priority         0                    0
Max realtime priority     0                    0
Max realtime timeout      unlimited            unlimited            us
/tmp/test.6: Too many open files at run.pl line 13, <$fh> line 1.
test.service: Main process exited, code=exited, status=24/n/a
test.service: Failed with result 'exit-code'.
Failed to start test.

試しにLimitNOFILE=10にしてみた様子．逆方向にもちゃんと絞れていることがわかります．