ArchitectureSecurity model
If the host has no more memory
The limits are caps, not reservations. If the host has no more memory, containers stop before ferryd.
The sum of the limits can be more than the memory of the host. Nothing tests it.
1 / 3
A resource limit is a cap. It does not reserve memory. If the host itself has no more memory, the OOM killer chooses a process to stop among all the processes.
Who goes first
| Process | OOM score adjustment |
|---|---|
ferryd, on Linux | --oom-score-adj, default -500: the containers go first |
git and the docker CLI, which ferryd starts | Reset to 0. A runaway git does not survive at the cost of apps and databases. |
| Containers | They never inherit the score, because Docker starts them. |
What to do
Make sure that the limits fit the host. See Resource limits and Production setup.
To lower the score, ferryd must be root or have CAP_SYS_RESOURCE. Without them, ferryd writes a warning in its log. The warning tells you to set OOMScoreAdjust= in the systemd unit of ferryd.
A service manager can set a lower value, for example with OOMScoreAdjust= of systemd. ferryd never raises that value.