pid-limit参数实验

fork炸弹命令

:(){ :|:& };:

可以看到，如果docker没有限制，会遭到fork炸弹恶意攻击的话，主机直接挂

防御

最开始发现有个ulimit参数，但是对于ulimit设置，其中有个nproc配置来说，不是限制每个容器的，在linux上是作用于用户的eguid，也就是针对用户的pid数量限制

The nproc limit is a bit of a special case, in that it does sum over all the processes of a user. Nonetheless, it still applies per-process: when a process calls fork to create a new process, the call is denied if the number of processes belonging to the process's euid is would be larger than the process's RLIMIT_NPROC value.

然后发现k8s 1.14后支持了pid cgoup的配置，但是支持pid cgroup需要内核，修改方法如下

通过命令ps aux查看配置文件路径

/usr/bin/kubelet --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/var/lib/kubelet/config.yaml --network-plugin=cni --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.6

可以得知kubeletconfig路径为，之后我们可以查看Kubelet Configuration (v1beta1) | Kubernetes

得知，可以通过配置podPidsLimit来限制

参考

https://www.cyberciti.biz/faq/understanding-bash-fork-bomb/

如何在Docker内部使用ulimit——如何在docker内部生成core - 简书

容器安全之配置合适的ulimit - 简书

Fork bomb prevention · Issue #6479 · moby/moby · GitHub

https://github.com/moby/moby/pull/9437

https://github.com/moby/moby/pull/18697

https://github.com/kubernetes/kubernetes/issues/43783

Process ID Limits And Reservations | Kubernetes

https://serverfault.com/questions/1022623/how-to-set-pid-limit-for-containers-in-kubernetes

https://stackoverflow.com/questions/56272911/how-to-set-pid-limit-in-kubernetes-pod

Kubelet Configuration (v1beta1) | Kubernetes

https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/