[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-branding":3,"category-de-performance":8},{"siteName":4,"primaryColor":5,"accentColor":6,"faviconUrl":7,"logoUrl":7},"KiroCloud","#ffffff","#888888","",[9],{"id":10,"title":11,"author":12,"body":13,"category":646,"description":647,"extension":648,"lastUpdated":649,"meta":650,"navigation":155,"order":152,"path":651,"readTime":652,"seo":653,"stem":654,"__hash__":655},"docs\u002Fdocs\u002Fde\u002Flinux-cgroups-limits.md","Linux Cgroups v2 & Kernel-Limits für Multi-Tenant Bot-Hosting","Luca Lichtenwald",{"type":14,"value":15,"toc":639},"minimark",[16,20,34,42,45,50,53,89,98,100,104,110,180,183,185,195,203,254,260,262,266,273,632,635],[17,18,11],"h1",{"id":19},"linux-cgroups-v2-kernel-limits-für-multi-tenant-bot-hosting",[21,22,23,24,28,29,33],"p",{},"Wenn mehrere Kunden-Bots auf einem gemeinsamen Linux-Server betrieben werden, kann ein fehlerhafter Bot mit einer Endlosschleife (",[25,26,27],"code",{},"while(true)",") oder einem Speicherleck die gesamte Maschine lahmlegen. Ohne Kernel-Einschränkungen beansprucht dieser Prozess 100 % aller CPU-Kerne, verdrängt andere Prozesse in die Swap-Partition und führt zum Absturz benachbarter Anwendungen (das klassische ",[30,31,32],"em",{},"\"Noisy Neighbor\"","-Problem).",[21,35,36,37,41],{},"Auf KiroCloud setzen wir auf ",[38,39,40],"strong",{},"Linux Control Groups (Cgroups v2)"," und systemd Resource Accounting, um jedem Bot-Container exakte Hard- und Soft-Limits für CPU, RAM und I\u002FO zuzuweisen.",[43,44],"hr",{},[46,47,49],"h2",{"id":48},"_1-was-sind-cgroups-v2","1. Was sind Cgroups v2?",[21,51,52],{},"Cgroups (Control Groups) sind eine Kernel-Funktion von Linux, die es erlaubt, Prozesse in hierarchischen Gruppen zu organisieren und deren Ressourcenverbrauch präzise zu drosseln:",[54,55,56,67,80],"ul",{},[57,58,59,66],"li",{},[38,60,61,62,65],{},"CPU Controller (",[25,63,64],{},"cpu.max","):"," Bestimmt, wie viel CPU-Zeit ein Prozess pro Zeitfenster nutzen darf.",[57,68,69,79],{},[38,70,71,72,75,76,65],{},"Memory Controller (",[25,73,74],{},"memory.max",", ",[25,77,78],{},"memory.high"," Begrenzt den physikalischen RAM-Verbrauch und steuert den Out-Of-Memory (OOM) Killer.",[57,81,82,88],{},[38,83,84,85,65],{},"IO Controller (",[25,86,87],{},"io.max"," Begrenzt Lese- und Schreiboperationen auf Enterprise-NVMe-SSDs, um I\u002FO-Staus zu verhindern.",[90,91,96],"pre",{"className":92,"code":94,"language":95},[93],"language-text","                  ┌───────────────────────────────┐\n                  │    Linux Kernel Cgroups v2    │\n                  └───────────────┬───────────────┘\n         ┌────────────────────────┼────────────────────────┐\n         ▼                        ▼                        ▼\n  \u002Fsys\u002Ffs\u002Fcgroup\u002F         \u002Fsys\u002Ffs\u002Fcgroup\u002F          \u002Fsys\u002Ffs\u002Fcgroup\u002F\n  bot-1234\u002F               bot-5678\u002F                bot-9999\u002F\n  ├── cpu.max: 50000      ├── cpu.max: 100000      ├── cpu.max: 200000\n  ├── memory.max: 512M    ├── memory.max: 1024M    ├── memory.max: 2048M\n  └── io.max: 50M\u002Fs       └── io.max: 50M\u002Fs        └── io.max: 100M\u002Fs\n","text",[25,97,94],{"__ignoreMap":7},[43,99],{},[46,101,103],{"id":102},"_2-cpu-quotas-konfigurieren-keine-100-last-durch-endlosschleifen","2. CPU-Quotas konfigurieren: Keine 100%-Last durch Endlosschleifen",[21,105,106,107,109],{},"Das CPU-Limit wird in ",[25,108,64],{}," als Bruchteil eines Quota-Fensters (Standard: 100.000 Mikrosekunden = 100 ms) definiert:",[90,111,115],{"className":112,"code":113,"language":114,"meta":7,"style":7},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# 50% eines CPU-Kerns: 50.000 Mikrosekunden pro 100.000 Mikrosekunden-Fenster\necho \"50000 100000\" > \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-alpha\u002Fcpu.max\n\n# 1,5 CPU-Kerne:\necho \"150000 100000\" > \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-beta\u002Fcpu.max\n","bash",[25,116,117,126,150,157,163],{"__ignoreMap":7},[118,119,122],"span",{"class":120,"line":121},"line",1,[118,123,125],{"class":124},"sHwdD","# 50% eines CPU-Kerns: 50.000 Mikrosekunden pro 100.000 Mikrosekunden-Fenster\n",[118,127,129,133,137,141,144,147],{"class":120,"line":128},2,[118,130,132],{"class":131},"s2Zo4","echo",[118,134,136],{"class":135},"sMK4o"," \"",[118,138,140],{"class":139},"sfazB","50000 100000",[118,142,143],{"class":135},"\"",[118,145,146],{"class":135}," >",[118,148,149],{"class":139}," \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-alpha\u002Fcpu.max\n",[118,151,153],{"class":120,"line":152},3,[118,154,156],{"emptyLinePlaceholder":155},true,"\n",[118,158,160],{"class":120,"line":159},4,[118,161,162],{"class":124},"# 1,5 CPU-Kerne:\n",[118,164,166,168,170,173,175,177],{"class":120,"line":165},5,[118,167,132],{"class":131},[118,169,136],{"class":135},[118,171,172],{"class":139},"150000 100000",[118,174,143],{"class":135},[118,176,146],{"class":135},[118,178,179],{"class":139}," \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-beta\u002Fcpu.max\n",[21,181,182],{},"Wenn ein Bot mehr CPU-Zeit anfordert, als ihm zusteht, drosselt der Linux Completely Fair Scheduler (CFS) den Prozess automatisch, ohne dass andere Bots auf dem Host davon beeinträchtigt werden.",[43,184],{},[46,186,188,189,191,192,194],{"id":187},"_3-memory-caps-sanfte-drosselung-memoryhigh-vs-memorymax","3. Memory Caps & Sanfte Drosselung (",[25,190,78],{}," vs. ",[25,193,74],{},")",[21,196,197,198,200,201,65],{},"In Cgroups v2 unterscheidet der Kernel zwischen einer sanften Warnschwelle (",[25,199,78],{},") und einer harten OOM-Grenze (",[25,202,74],{},[90,204,206],{"className":112,"code":205,"language":114,"meta":7,"style":7},"# Sanftes Limit: Ab 450 MB wird der Bot gedrosselt und aggressiv bereinigt\necho \"471859200\" > \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-alpha\u002Fmemory.high\n\n# Hartes Limit (512 MB): Bei Überschreitung greift der OOM-Killer\necho \"536870912\" > \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-alpha\u002Fmemory.max\n",[25,207,208,213,229,233,238],{"__ignoreMap":7},[118,209,210],{"class":120,"line":121},[118,211,212],{"class":124},"# Sanftes Limit: Ab 450 MB wird der Bot gedrosselt und aggressiv bereinigt\n",[118,214,215,217,219,222,224,226],{"class":120,"line":128},[118,216,132],{"class":131},[118,218,136],{"class":135},[118,220,221],{"class":139},"471859200",[118,223,143],{"class":135},[118,225,146],{"class":135},[118,227,228],{"class":139}," \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-alpha\u002Fmemory.high\n",[118,230,231],{"class":120,"line":152},[118,232,156],{"emptyLinePlaceholder":155},[118,234,235],{"class":120,"line":159},[118,236,237],{"class":124},"# Hartes Limit (512 MB): Bei Überschreitung greift der OOM-Killer\n",[118,239,240,242,244,247,249,251],{"class":120,"line":165},[118,241,132],{"class":131},[118,243,136],{"class":135},[118,245,246],{"class":139},"536870912",[118,248,143],{"class":135},[118,250,146],{"class":135},[118,252,253],{"class":139}," \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-alpha\u002Fmemory.max\n",[21,255,256,257,259],{},"Mit ",[25,258,78],{}," zwingt der Linux-Kernel den Prozess dazu, Page-Caches freizugeben und verlangsamt Speicherallokationen, bevor ein harter Crash eintritt.",[43,261],{},[46,263,265],{"id":264},"_4-automatisches-management-via-systemd-run-in-nodejs","4. Automatisches Management via systemd-run in Node.js",[21,267,268,269,272],{},"Anstatt Cgroups manuell im Pseudo-Dateisystem zu beschreiben, nutzt die KiroCloud Bot Engine ",[25,270,271],{},"systemd-run",":",[90,274,278],{"className":275,"code":276,"language":277,"meta":7,"style":7},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { execSync } from 'node:child_process';\n\nexport function startBotWithCgroups(botId: string, scriptPath: string) {\n  const serviceName = `kiro-bot-${botId}`;\n\n  const cmd = [\n    'systemd-run',\n    `--unit=${serviceName}`,\n    '--slice=kiro-bots.slice',\n    '--property=CPUQuota=75%',\n    '--property=MemoryMax=512M',\n    '--property=MemoryHigh=450M',\n    '--property=TasksMax=100', \u002F\u002F Schutz vor Fork-Bomben\n    '--property=Restart=on-failure',\n    'node', scriptPath,\n  ].join(' ');\n\n  execSync(cmd, { stdio: 'inherit' });\n  console.log(`[Cgroups] Bot ${botId} erfolgreich isoliert als ${serviceName} gestartet.`);\n}\n","typescript",[25,279,280,311,315,355,382,386,400,413,431,443,455,467,479,494,506,522,544,549,582,626],{"__ignoreMap":7},[118,281,282,286,289,293,296,299,302,305,308],{"class":120,"line":121},[118,283,285],{"class":284},"s7zQu","import",[118,287,288],{"class":135}," {",[118,290,292],{"class":291},"sTEyZ"," execSync",[118,294,295],{"class":135}," }",[118,297,298],{"class":284}," from",[118,300,301],{"class":135}," '",[118,303,304],{"class":139},"node:child_process",[118,306,307],{"class":135},"'",[118,309,310],{"class":135},";\n",[118,312,313],{"class":120,"line":128},[118,314,156],{"emptyLinePlaceholder":155},[118,316,317,320,324,327,330,334,336,340,343,346,348,350,352],{"class":120,"line":152},[118,318,319],{"class":284},"export",[118,321,323],{"class":322},"spNyl"," function",[118,325,326],{"class":131}," startBotWithCgroups",[118,328,329],{"class":135},"(",[118,331,333],{"class":332},"sHdIc","botId",[118,335,272],{"class":135},[118,337,339],{"class":338},"sBMFI"," string",[118,341,342],{"class":135},",",[118,344,345],{"class":332}," scriptPath",[118,347,272],{"class":135},[118,349,339],{"class":338},[118,351,194],{"class":135},[118,353,354],{"class":135}," {\n",[118,356,357,360,363,366,369,372,375,377,380],{"class":120,"line":159},[118,358,359],{"class":322},"  const",[118,361,362],{"class":291}," serviceName",[118,364,365],{"class":135}," =",[118,367,368],{"class":135}," `",[118,370,371],{"class":139},"kiro-bot-",[118,373,374],{"class":135},"${",[118,376,333],{"class":291},[118,378,379],{"class":135},"}`",[118,381,310],{"class":135},[118,383,384],{"class":120,"line":165},[118,385,156],{"emptyLinePlaceholder":155},[118,387,389,391,394,396],{"class":120,"line":388},6,[118,390,359],{"class":322},[118,392,393],{"class":291}," cmd",[118,395,365],{"class":135},[118,397,399],{"class":398},"swJcz"," [\n",[118,401,403,406,408,410],{"class":120,"line":402},7,[118,404,405],{"class":135},"    '",[118,407,271],{"class":139},[118,409,307],{"class":135},[118,411,412],{"class":135},",\n",[118,414,416,419,422,424,427,429],{"class":120,"line":415},8,[118,417,418],{"class":135},"    `",[118,420,421],{"class":139},"--unit=",[118,423,374],{"class":135},[118,425,426],{"class":291},"serviceName",[118,428,379],{"class":135},[118,430,412],{"class":135},[118,432,434,436,439,441],{"class":120,"line":433},9,[118,435,405],{"class":135},[118,437,438],{"class":139},"--slice=kiro-bots.slice",[118,440,307],{"class":135},[118,442,412],{"class":135},[118,444,446,448,451,453],{"class":120,"line":445},10,[118,447,405],{"class":135},[118,449,450],{"class":139},"--property=CPUQuota=75%",[118,452,307],{"class":135},[118,454,412],{"class":135},[118,456,458,460,463,465],{"class":120,"line":457},11,[118,459,405],{"class":135},[118,461,462],{"class":139},"--property=MemoryMax=512M",[118,464,307],{"class":135},[118,466,412],{"class":135},[118,468,470,472,475,477],{"class":120,"line":469},12,[118,471,405],{"class":135},[118,473,474],{"class":139},"--property=MemoryHigh=450M",[118,476,307],{"class":135},[118,478,412],{"class":135},[118,480,482,484,487,489,491],{"class":120,"line":481},13,[118,483,405],{"class":135},[118,485,486],{"class":139},"--property=TasksMax=100",[118,488,307],{"class":135},[118,490,342],{"class":135},[118,492,493],{"class":124}," \u002F\u002F Schutz vor Fork-Bomben\n",[118,495,497,499,502,504],{"class":120,"line":496},14,[118,498,405],{"class":135},[118,500,501],{"class":139},"--property=Restart=on-failure",[118,503,307],{"class":135},[118,505,412],{"class":135},[118,507,509,511,514,516,518,520],{"class":120,"line":508},15,[118,510,405],{"class":135},[118,512,513],{"class":139},"node",[118,515,307],{"class":135},[118,517,342],{"class":135},[118,519,345],{"class":291},[118,521,412],{"class":135},[118,523,525,528,531,534,536,538,540,542],{"class":120,"line":524},16,[118,526,527],{"class":398},"  ]",[118,529,530],{"class":135},".",[118,532,533],{"class":131},"join",[118,535,329],{"class":398},[118,537,307],{"class":135},[118,539,301],{"class":135},[118,541,194],{"class":398},[118,543,310],{"class":135},[118,545,547],{"class":120,"line":546},17,[118,548,156],{"emptyLinePlaceholder":155},[118,550,552,555,557,560,562,564,567,569,571,574,576,578,580],{"class":120,"line":551},18,[118,553,554],{"class":131},"  execSync",[118,556,329],{"class":398},[118,558,559],{"class":291},"cmd",[118,561,342],{"class":135},[118,563,288],{"class":135},[118,565,566],{"class":398}," stdio",[118,568,272],{"class":135},[118,570,301],{"class":135},[118,572,573],{"class":139},"inherit",[118,575,307],{"class":135},[118,577,295],{"class":135},[118,579,194],{"class":398},[118,581,310],{"class":135},[118,583,585,588,590,593,595,598,601,603,605,608,611,613,615,617,620,622,624],{"class":120,"line":584},19,[118,586,587],{"class":291},"  console",[118,589,530],{"class":135},[118,591,592],{"class":131},"log",[118,594,329],{"class":398},[118,596,597],{"class":135},"`",[118,599,600],{"class":139},"[Cgroups] Bot ",[118,602,374],{"class":135},[118,604,333],{"class":291},[118,606,607],{"class":135},"}",[118,609,610],{"class":139}," erfolgreich isoliert als ",[118,612,374],{"class":135},[118,614,426],{"class":291},[118,616,607],{"class":135},[118,618,619],{"class":139}," gestartet.",[118,621,597],{"class":135},[118,623,194],{"class":398},[118,625,310],{"class":135},[118,627,629],{"class":120,"line":628},20,[118,630,631],{"class":135},"}\n",[21,633,634],{},"Mit dieser Architektur garantieren wir auf KiroCloud maximale Ausfallsicherheit und absolute Fair-Share-Verteilung aller Host-Ressourcen.",[636,637,638],"style",{},"html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}",{"title":7,"searchDepth":128,"depth":128,"links":640},[641,642,643,645],{"id":48,"depth":128,"text":49},{"id":102,"depth":128,"text":103},{"id":187,"depth":128,"text":644},"3. Memory Caps & Sanfte Drosselung (memory.high vs. memory.max)",{"id":264,"depth":128,"text":265},"performance","Leitfaden zur Prozess- und Ressourcenisolation unter Linux. Cgroups v2, CPU Quotas, Memory Caps und Schutz vor Noisy Neighbors in der Cloud.","md","2026-10-09",{},"\u002Fdocs\u002Fde\u002Flinux-cgroups-limits","12 min",{"title":11,"description":647},"docs\u002Fde\u002Flinux-cgroups-limits","B9U-V5RXHtVsYvTBapzUoyf0Cff3NfzM5soYriUzK8A"]