{"slug": "resource-contraints-with-cgroups-pam-on-a-multi-user-system", "title": "Resource contraints with cgroups & pam on a multi-user system", "summary": "A system administrator on the Level1Techs forum is seeking training materials to understand and configure cgroups v2 and PAM resource limits for multi-user HPC systems, citing a lack of comprehensive tutorials. The admin shared a working configuration using systemd slice settings to limit CPU, memory, I/O, and process counts, and noted the need for additional steps like installing systemd-oomd and enabling PSI.", "body_md": "[mtwest](https://forum.level1techs.com/u/mtwest)\n1\nThe Issue\n\nDoes anyone know of well written / produced training materials to help someone understand resource controls in user space? Given that multi-(human)user interactive servers aren’t the major focus of commercial IT these days, it’s a little hard to find good material on how to manage such things.\n\nOver the past month, I have been trying piece together `limits.conf`\n\nfiles for both `pam_limits`\n\nand `user-.slice.d`\n\nfrom bits scattered across multiple forums & docs pages and have found myself not understand the technology behind the various threshold variables as much as I’d like.\n\nLike, I have stuff in files that works, BUT I don’t feel like I could explain it to anyone else very well. *Also* I steadfastly refuse to use *stochastic text extruders* for this sort of work, so please don’t regurgitate something you got from LLM + code generation harness of choice.\n\nSome References\n\nLinux Weekly News at [https://lwn.net/](https://lwn.net/) has been a resource I’ve followed for over two decades. It’s the best summary, look at the history of the development of cgroups v1 and v2 at [https://lwn.net/Kernel/Index/#Memory_management-Control_groups](https://lwn.net/Kernel/Index/#Memory_management-Control_groups).\n\n1 Like\n\n[mtwest](https://forum.level1techs.com/u/mtwest)\n3\nWhile the LWN Kernel page definitely does give a lot of nice historical context to so many different components within the Linux kernel, I must disagree with it being a good *summary* of anything but very deep technical discussions of implementation questions, and even then.\n\nI guess I am looking more for tutorials on how best to set resource flags, particular for human users, and the motivation behind each of the choices. Maybe that material just doesn’t exist and I need to write it myself.\n\nMulti-tennant systems aren’t uncommon, but it’s maybe worth clarifying what that actually means to you. “commercial IT” has been tacked more user isolation and introduced something called namespaces, and started giving users their own mount, process, and device namespaces. Congratulations, you’ve now just invented containers.\n\nSeriously though, a container is just a bunch of cgroups and namespaces in a trenchcoat. What are you looking for exactly?\n\n[mtwest](https://forum.level1techs.com/u/mtwest)\n6\nPurpose\n\nI am trying to limit resource pressure on an HPC cluster submit host, especially as the number of users running LLM code-generator services with `--dangerously-skip-permissions`\n\ngrows weekly. So the hope is to set up a bunch of constraints via CgroupsV2 so I don’t have to, as often, play whack-a-mole with processes in user space\n\nConfig Best Practices\n\nI have been able to cobble together a bunch of settings from conversations with others\n\n```\n[Slice]\nCPUQuota=200%\nIPAccounting=yes\n; Memory management\nMemoryAccounting=yes\nMemoryMax=4G\nMemoryHigh=3G\nMemoryZSwapMax=1G\nManagedOOMMemoryPressure=kill\nManagedOOMMemoryPressureLimit=70%\nManagedOOMMemoryPressureDurationSec=20s\nMemorySwapMax=1G\nManagedOOMSwap=kill\n; Process count limitation\nTasksAccounting=yes\nTasksMax=256\n; Local IO limits\nIOAccounting=yes\nIOWeight=10\n```\n\nAdditional steps\n\nBut having found all of these recommendations, then I run into a bunch of additional work that needs to be done that no one mentioned before.\n\n- installed\n`systemd-oomd`\n\nand start the service\n- how to set up\n`zswap`\n\n- turn on\n`PSI`\n\nin the kernel\n\nAnd there are definitely more that aren’t immediately related to managing slice resource usage via cgroups.\n\n[mtwest](https://forum.level1techs.com/u/mtwest)\n7\nEach cluster maintainers will have a different tolerance to resource usage, so thresholds will be set differently. And that is fine. But I cannot be the only one wanting to manage user slices in these sorts of ways, right?\n\nMaybe this is just an indication that I need to start writing up this material myself. Just am a bit boggled this sort of stuff doesn’t exist already someplace else.\n\n[mtwest](https://forum.level1techs.com/u/mtwest)\n8\nPersistence Issue\n\nWhile I can with ease get `zswap`\n\nworking at runtime by editing\n\n```\nsys/module/zswap/parameters/enabled\n```\n\ntrying to make it always come back up after a reboot is being more difficult.\n\nUsing grubby for config updates\n\nHaving used [grubby](https://linux.die.net/man/8/grubby) before to add optional flag values to the used kernel, I figured this would be straightforward, as various webpages have indicated.\n\n```\nsudo grubby \\\n--update-kernel=/boot/vmlinuz-$(uname -r) \\\n--args=\"zswap.enabled=1\"\n```\n\nThe value is taken up but upon reboot, I cannot SSH to the machine. Now I don’t think it’s doing anything with SSH perse. Just that is the most obvious indicator that something went wrong. In trying to debug this, I get pointed at `/etc/initramfs-tools/modules`\n\nbut that doesn’t exist on my system. Also a few of these pages are a decade old and stuff shifts in all sorts of ways. Hence asking here if anyone knows more up-to-date info on how to make this work.\n\n[mtwest](https://forum.level1techs.com/u/mtwest)\n9\nRHEL systems don’t have the `initramfs-tools`\n\npackage as its a Debian-family thing. AFAICT, the RHEL equivalent is `dracut`\n\nbut now it’s a matter of determining what the equivalent set of commands is as most of online docs are for debian/ubuntu/etc systems. Sigh…", "url": "https://wpnews.pro/news/resource-contraints-with-cgroups-pam-on-a-multi-user-system", "canonical_source": "https://forum.level1techs.com/t/resource-contraints-with-cgroups-pam-on-a-multi-user-system/253803#post_9", "published_at": "2026-08-18 00:22:48+00:00", "updated_at": "2026-08-18 00:41:15.947716+00:00", "lang": "en", "topics": ["mlops", "ai-infrastructure"], "entities": ["Level1Techs", "Linux", "cgroups v2", "PAM", "systemd", "systemd-oomd", "HPC"], "alternates": {"html": "https://wpnews.pro/news/resource-contraints-with-cgroups-pam-on-a-multi-user-system", "markdown": "https://wpnews.pro/news/resource-contraints-with-cgroups-pam-on-a-multi-user-system.md", "text": "https://wpnews.pro/news/resource-contraints-with-cgroups-pam-on-a-multi-user-system.txt", "jsonld": "https://wpnews.pro/news/resource-contraints-with-cgroups-pam-on-a-multi-user-system.jsonld"}}