[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-branding":3,"content-de-linux-cgroups-limits":8,"public-ads-config":655},{"siteName":4,"primaryColor":5,"accentColor":6,"faviconUrl":7,"logoUrl":7},"KiroCloud","#ffffff","#888888","",{"id":9,"title":10,"author":11,"body":12,"category":645,"description":646,"extension":647,"lastUpdated":648,"meta":649,"navigation":154,"order":151,"path":650,"readTime":651,"seo":652,"stem":653,"__hash__":654},"docs\u002Fdocs\u002Fde\u002Flinux-cgroups-limits.md","Linux Cgroups v2 & Kernel-Limits für Multi-Tenant Bot-Hosting","Luca Lichtenwald",{"type":13,"value":14,"toc":638},"minimark",[15,19,33,41,44,49,52,88,97,99,103,109,179,182,184,194,202,253,259,261,265,272,631,634],[16,17,10],"h1",{"id":18},"linux-cgroups-v2-kernel-limits-für-multi-tenant-bot-hosting",[20,21,22,23,27,28,32],"p",{},"Wenn mehrere Kunden-Bots auf einem gemeinsamen Linux-Server betrieben werden, kann ein fehlerhafter Bot mit einer Endlosschleife (",[24,25,26],"code",{},"while(true)",") oder einem Speicherleck die gesamte Maschine lahmlegen. Ohne Kernel-Einschränkungen beansprucht dieser Prozess 100 % aller CPU-Kerne, verdrängt andere Prozesse in die Swap-Partition und führt zum Absturz benachbarter Anwendungen (das klassische ",[29,30,31],"em",{},"\"Noisy Neighbor\"","-Problem).",[20,34,35,36,40],{},"Auf KiroCloud setzen wir auf ",[37,38,39],"strong",{},"Linux Control Groups (Cgroups v2)"," und systemd Resource Accounting, um jedem Bot-Container exakte Hard- und Soft-Limits für CPU, RAM und I\u002FO zuzuweisen.",[42,43],"hr",{},[45,46,48],"h2",{"id":47},"_1-was-sind-cgroups-v2","1. Was sind Cgroups v2?",[20,50,51],{},"Cgroups (Control Groups) sind eine Kernel-Funktion von Linux, die es erlaubt, Prozesse in hierarchischen Gruppen zu organisieren und deren Ressourcenverbrauch präzise zu drosseln:",[53,54,55,66,79],"ul",{},[56,57,58,65],"li",{},[37,59,60,61,64],{},"CPU Controller (",[24,62,63],{},"cpu.max","):"," Bestimmt, wie viel CPU-Zeit ein Prozess pro Zeitfenster nutzen darf.",[56,67,68,78],{},[37,69,70,71,74,75,64],{},"Memory Controller (",[24,72,73],{},"memory.max",", ",[24,76,77],{},"memory.high"," Begrenzt den physikalischen RAM-Verbrauch und steuert den Out-Of-Memory (OOM) Killer.",[56,80,81,87],{},[37,82,83,84,64],{},"IO Controller (",[24,85,86],{},"io.max"," Begrenzt Lese- und Schreiboperationen auf Enterprise-NVMe-SSDs, um I\u002FO-Staus zu verhindern.",[89,90,95],"pre",{"className":91,"code":93,"language":94},[92],"language-text","                  ┌───────────────────────────────┐\n                  │    Linux Kernel Cgroups v2    │\n                  └───────────────┬───────────────┘\n         ┌────────────────────────┼────────────────────────┐\n         ▼                        ▼                        ▼\n  \u002Fsys\u002Ffs\u002Fcgroup\u002F         \u002Fsys\u002Ffs\u002Fcgroup\u002F          \u002Fsys\u002Ffs\u002Fcgroup\u002F\n  bot-1234\u002F               bot-5678\u002F                bot-9999\u002F\n  ├── cpu.max: 50000      ├── cpu.max: 100000      ├── cpu.max: 200000\n  ├── memory.max: 512M    ├── memory.max: 1024M    ├── memory.max: 2048M\n  └── io.max: 50M\u002Fs       └── io.max: 50M\u002Fs        └── io.max: 100M\u002Fs\n","text",[24,96,93],{"__ignoreMap":7},[42,98],{},[45,100,102],{"id":101},"_2-cpu-quotas-konfigurieren-keine-100-last-durch-endlosschleifen","2. CPU-Quotas konfigurieren: Keine 100%-Last durch Endlosschleifen",[20,104,105,106,108],{},"Das CPU-Limit wird in ",[24,107,63],{}," als Bruchteil eines Quota-Fensters (Standard: 100.000 Mikrosekunden = 100 ms) definiert:",[89,110,114],{"className":111,"code":112,"language":113,"meta":7,"style":7},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# 50% eines CPU-Kerns: 50.000 Mikrosekunden pro 100.000 Mikrosekunden-Fenster\necho \"50000 100000\" > \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-alpha\u002Fcpu.max\n\n# 1,5 CPU-Kerne:\necho \"150000 100000\" > \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-beta\u002Fcpu.max\n","bash",[24,115,116,125,149,156,162],{"__ignoreMap":7},[117,118,121],"span",{"class":119,"line":120},"line",1,[117,122,124],{"class":123},"sHwdD","# 50% eines CPU-Kerns: 50.000 Mikrosekunden pro 100.000 Mikrosekunden-Fenster\n",[117,126,128,132,136,140,143,146],{"class":119,"line":127},2,[117,129,131],{"class":130},"s2Zo4","echo",[117,133,135],{"class":134},"sMK4o"," \"",[117,137,139],{"class":138},"sfazB","50000 100000",[117,141,142],{"class":134},"\"",[117,144,145],{"class":134}," >",[117,147,148],{"class":138}," \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-alpha\u002Fcpu.max\n",[117,150,152],{"class":119,"line":151},3,[117,153,155],{"emptyLinePlaceholder":154},true,"\n",[117,157,159],{"class":119,"line":158},4,[117,160,161],{"class":123},"# 1,5 CPU-Kerne:\n",[117,163,165,167,169,172,174,176],{"class":119,"line":164},5,[117,166,131],{"class":130},[117,168,135],{"class":134},[117,170,171],{"class":138},"150000 100000",[117,173,142],{"class":134},[117,175,145],{"class":134},[117,177,178],{"class":138}," \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-beta\u002Fcpu.max\n",[20,180,181],{},"Wenn ein Bot mehr CPU-Zeit anfordert, als ihm zusteht, drosselt der Linux Completely Fair Scheduler (CFS) den Prozess automatisch, ohne dass andere Bots auf dem Host davon beeinträchtigt werden.",[42,183],{},[45,185,187,188,190,191,193],{"id":186},"_3-memory-caps-sanfte-drosselung-memoryhigh-vs-memorymax","3. Memory Caps & Sanfte Drosselung (",[24,189,77],{}," vs. ",[24,192,73],{},")",[20,195,196,197,199,200,64],{},"In Cgroups v2 unterscheidet der Kernel zwischen einer sanften Warnschwelle (",[24,198,77],{},") und einer harten OOM-Grenze (",[24,201,73],{},[89,203,205],{"className":111,"code":204,"language":113,"meta":7,"style":7},"# Sanftes Limit: Ab 450 MB wird der Bot gedrosselt und aggressiv bereinigt\necho \"471859200\" > \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-alpha\u002Fmemory.high\n\n# Hartes Limit (512 MB): Bei Überschreitung greift der OOM-Killer\necho \"536870912\" > \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-alpha\u002Fmemory.max\n",[24,206,207,212,228,232,237],{"__ignoreMap":7},[117,208,209],{"class":119,"line":120},[117,210,211],{"class":123},"# Sanftes Limit: Ab 450 MB wird der Bot gedrosselt und aggressiv bereinigt\n",[117,213,214,216,218,221,223,225],{"class":119,"line":127},[117,215,131],{"class":130},[117,217,135],{"class":134},[117,219,220],{"class":138},"471859200",[117,222,142],{"class":134},[117,224,145],{"class":134},[117,226,227],{"class":138}," \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-alpha\u002Fmemory.high\n",[117,229,230],{"class":119,"line":151},[117,231,155],{"emptyLinePlaceholder":154},[117,233,234],{"class":119,"line":158},[117,235,236],{"class":123},"# Hartes Limit (512 MB): Bei Überschreitung greift der OOM-Killer\n",[117,238,239,241,243,246,248,250],{"class":119,"line":164},[117,240,131],{"class":130},[117,242,135],{"class":134},[117,244,245],{"class":138},"536870912",[117,247,142],{"class":134},[117,249,145],{"class":134},[117,251,252],{"class":138}," \u002Fsys\u002Ffs\u002Fcgroup\u002Fkiro-bots\u002Fbot-alpha\u002Fmemory.max\n",[20,254,255,256,258],{},"Mit ",[24,257,77],{}," zwingt der Linux-Kernel den Prozess dazu, Page-Caches freizugeben und verlangsamt Speicherallokationen, bevor ein harter Crash eintritt.",[42,260],{},[45,262,264],{"id":263},"_4-automatisches-management-via-systemd-run-in-nodejs","4. Automatisches Management via systemd-run in Node.js",[20,266,267,268,271],{},"Anstatt Cgroups manuell im Pseudo-Dateisystem zu beschreiben, nutzt die KiroCloud Bot Engine ",[24,269,270],{},"systemd-run",":",[89,273,277],{"className":274,"code":275,"language":276,"meta":7,"style":7},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { execSync } from 'node:child_process';\n\nexport function startBotWithCgroups(botId: string, scriptPath: string) {\n  const serviceName = `kiro-bot-${botId}`;\n\n  const cmd = [\n    'systemd-run',\n    `--unit=${serviceName}`,\n    '--slice=kiro-bots.slice',\n    '--property=CPUQuota=75%',\n    '--property=MemoryMax=512M',\n    '--property=MemoryHigh=450M',\n    '--property=TasksMax=100', \u002F\u002F Schutz vor Fork-Bomben\n    '--property=Restart=on-failure',\n    'node', scriptPath,\n  ].join(' ');\n\n  execSync(cmd, { stdio: 'inherit' });\n  console.log(`[Cgroups] Bot ${botId} erfolgreich isoliert als ${serviceName} gestartet.`);\n}\n","typescript",[24,278,279,310,314,354,381,385,399,412,430,442,454,466,478,493,505,521,543,548,581,625],{"__ignoreMap":7},[117,280,281,285,288,292,295,298,301,304,307],{"class":119,"line":120},[117,282,284],{"class":283},"s7zQu","import",[117,286,287],{"class":134}," {",[117,289,291],{"class":290},"sTEyZ"," execSync",[117,293,294],{"class":134}," }",[117,296,297],{"class":283}," from",[117,299,300],{"class":134}," '",[117,302,303],{"class":138},"node:child_process",[117,305,306],{"class":134},"'",[117,308,309],{"class":134},";\n",[117,311,312],{"class":119,"line":127},[117,313,155],{"emptyLinePlaceholder":154},[117,315,316,319,323,326,329,333,335,339,342,345,347,349,351],{"class":119,"line":151},[117,317,318],{"class":283},"export",[117,320,322],{"class":321},"spNyl"," function",[117,324,325],{"class":130}," startBotWithCgroups",[117,327,328],{"class":134},"(",[117,330,332],{"class":331},"sHdIc","botId",[117,334,271],{"class":134},[117,336,338],{"class":337},"sBMFI"," string",[117,340,341],{"class":134},",",[117,343,344],{"class":331}," scriptPath",[117,346,271],{"class":134},[117,348,338],{"class":337},[117,350,193],{"class":134},[117,352,353],{"class":134}," {\n",[117,355,356,359,362,365,368,371,374,376,379],{"class":119,"line":158},[117,357,358],{"class":321},"  const",[117,360,361],{"class":290}," serviceName",[117,363,364],{"class":134}," =",[117,366,367],{"class":134}," `",[117,369,370],{"class":138},"kiro-bot-",[117,372,373],{"class":134},"${",[117,375,332],{"class":290},[117,377,378],{"class":134},"}`",[117,380,309],{"class":134},[117,382,383],{"class":119,"line":164},[117,384,155],{"emptyLinePlaceholder":154},[117,386,388,390,393,395],{"class":119,"line":387},6,[117,389,358],{"class":321},[117,391,392],{"class":290}," cmd",[117,394,364],{"class":134},[117,396,398],{"class":397},"swJcz"," [\n",[117,400,402,405,407,409],{"class":119,"line":401},7,[117,403,404],{"class":134},"    '",[117,406,270],{"class":138},[117,408,306],{"class":134},[117,410,411],{"class":134},",\n",[117,413,415,418,421,423,426,428],{"class":119,"line":414},8,[117,416,417],{"class":134},"    `",[117,419,420],{"class":138},"--unit=",[117,422,373],{"class":134},[117,424,425],{"class":290},"serviceName",[117,427,378],{"class":134},[117,429,411],{"class":134},[117,431,433,435,438,440],{"class":119,"line":432},9,[117,434,404],{"class":134},[117,436,437],{"class":138},"--slice=kiro-bots.slice",[117,439,306],{"class":134},[117,441,411],{"class":134},[117,443,445,447,450,452],{"class":119,"line":444},10,[117,446,404],{"class":134},[117,448,449],{"class":138},"--property=CPUQuota=75%",[117,451,306],{"class":134},[117,453,411],{"class":134},[117,455,457,459,462,464],{"class":119,"line":456},11,[117,458,404],{"class":134},[117,460,461],{"class":138},"--property=MemoryMax=512M",[117,463,306],{"class":134},[117,465,411],{"class":134},[117,467,469,471,474,476],{"class":119,"line":468},12,[117,470,404],{"class":134},[117,472,473],{"class":138},"--property=MemoryHigh=450M",[117,475,306],{"class":134},[117,477,411],{"class":134},[117,479,481,483,486,488,490],{"class":119,"line":480},13,[117,482,404],{"class":134},[117,484,485],{"class":138},"--property=TasksMax=100",[117,487,306],{"class":134},[117,489,341],{"class":134},[117,491,492],{"class":123}," \u002F\u002F Schutz vor Fork-Bomben\n",[117,494,496,498,501,503],{"class":119,"line":495},14,[117,497,404],{"class":134},[117,499,500],{"class":138},"--property=Restart=on-failure",[117,502,306],{"class":134},[117,504,411],{"class":134},[117,506,508,510,513,515,517,519],{"class":119,"line":507},15,[117,509,404],{"class":134},[117,511,512],{"class":138},"node",[117,514,306],{"class":134},[117,516,341],{"class":134},[117,518,344],{"class":290},[117,520,411],{"class":134},[117,522,524,527,530,533,535,537,539,541],{"class":119,"line":523},16,[117,525,526],{"class":397},"  ]",[117,528,529],{"class":134},".",[117,531,532],{"class":130},"join",[117,534,328],{"class":397},[117,536,306],{"class":134},[117,538,300],{"class":134},[117,540,193],{"class":397},[117,542,309],{"class":134},[117,544,546],{"class":119,"line":545},17,[117,547,155],{"emptyLinePlaceholder":154},[117,549,551,554,556,559,561,563,566,568,570,573,575,577,579],{"class":119,"line":550},18,[117,552,553],{"class":130},"  execSync",[117,555,328],{"class":397},[117,557,558],{"class":290},"cmd",[117,560,341],{"class":134},[117,562,287],{"class":134},[117,564,565],{"class":397}," stdio",[117,567,271],{"class":134},[117,569,300],{"class":134},[117,571,572],{"class":138},"inherit",[117,574,306],{"class":134},[117,576,294],{"class":134},[117,578,193],{"class":397},[117,580,309],{"class":134},[117,582,584,587,589,592,594,597,600,602,604,607,610,612,614,616,619,621,623],{"class":119,"line":583},19,[117,585,586],{"class":290},"  console",[117,588,529],{"class":134},[117,590,591],{"class":130},"log",[117,593,328],{"class":397},[117,595,596],{"class":134},"`",[117,598,599],{"class":138},"[Cgroups] Bot ",[117,601,373],{"class":134},[117,603,332],{"class":290},[117,605,606],{"class":134},"}",[117,608,609],{"class":138}," erfolgreich isoliert als ",[117,611,373],{"class":134},[117,613,425],{"class":290},[117,615,606],{"class":134},[117,617,618],{"class":138}," gestartet.",[117,620,596],{"class":134},[117,622,193],{"class":397},[117,624,309],{"class":134},[117,626,628],{"class":119,"line":627},20,[117,629,630],{"class":134},"}\n",[20,632,633],{},"Mit dieser Architektur garantieren wir auf KiroCloud maximale Ausfallsicherheit und absolute Fair-Share-Verteilung aller Host-Ressourcen.",[635,636,637],"style",{},"html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}",{"title":7,"searchDepth":127,"depth":127,"links":639},[640,641,642,644],{"id":47,"depth":127,"text":48},{"id":101,"depth":127,"text":102},{"id":186,"depth":127,"text":643},"3. Memory Caps & Sanfte Drosselung (memory.high vs. memory.max)",{"id":263,"depth":127,"text":264},"performance","Leitfaden zur Prozess- und Ressourcenisolation unter Linux. Cgroups v2, CPU Quotas, Memory Caps und Schutz vor Noisy Neighbors in der Cloud.","md","2026-10-09",{},"\u002Fdocs\u002Fde\u002Flinux-cgroups-limits","12 min",{"title":10,"description":646},"docs\u002Fde\u002Flinux-cgroups-limits","B9U-V5RXHtVsYvTBapzUoyf0Cff3NfzM5soYriUzK8A",{"enabled":154,"clientPubId":656,"docsSlotId":7,"newsSlotId":7,"guidesSlotId":7,"dashboardSlotId":7,"docsEnabled":154,"newsEnabled":154,"guidesEnabled":154,"dashboardEnabled":154},"ca-pub-9454065621077312"]