@@ -215,7 +215,8 @@ limits you defined.
|
215 | 215 | as restartable, Kubernetes restarts the container.
|
216 | 216 | - The memory limit for the Pod or container can also apply to pages in memory backed
|
217 | 217 | volumes, such as an `emptyDir`. The kubelet tracks `tmpfs` emptyDir volumes as container
|
218 |
| -memory use, rather than as local ephemeral storage. |
| 218 | +memory use, rather than as local ephemeral storage. When using memory backed `emptyDir`, |
| 219 | +be sure to check the notes [below](#memory-backed-emptydir). |
219 | 220 |
|
220 | 221 | If a container exceeds its memory request and the node that it runs on becomes short of
|
221 | 222 | memory overall, it is likely that the Pod the container belongs to will be
|
@@ -237,6 +238,50 @@ are available in your cluster, then Pod resource usage can be retrieved either
|
237 | 238 | from the [Metrics API](/docs/tasks/debug/debug-cluster/resource-metrics-pipeline/#metrics-api)
|
238 | 239 | directly or from your monitoring tools.
|
239 | 240 |
|
| 241 | +### Considerations for memory backed `emptyDir` volumes {#memory-backed-emptydir} |
| 242 | + |
| 243 | +{{< caution >}} |
| 244 | +If you do not specify a `sizeLimit` for an `emptyDir` volume, that volume may |
| 245 | +consume up to that pod's memory limit (`Pod.spec.containers[].resources.limits.memory`). |
| 246 | +If you do not set a memory limit, the pod has no upper bound on memory consumption, |
| 247 | +and can consume all available memory on the node. Kubernetes schedules pods based |
| 248 | +on resource requests (`Pod.spec.containers[].resources.requests`) and will not |
| 249 | +consider memory usage above the request when deciding if another pod can fit on |
| 250 | +a given node. This can result in a denial of service and cause the OS to do |
| 251 | +out-of-memory (OOM) handling. It is possible to create any number of `emptyDir`s |
| 252 | +that could potentially consume all available memory on the node, making OOM |
| 253 | +more likely. |
| 254 | +{{< /caution >}} |
| 255 | + |
| 256 | +From the perspective of memory management, there are some similarities between |
| 257 | +when a process uses memory as a work area and when using memory-backed |
| 258 | +`emptyDir`. But when using memory as a volume like memory-backed `emptyDir`, |
| 259 | +there are additional points below that you should be careful of. |
| 260 | + |
| 261 | +* Files stored on a memory-backed volume are almost entirely managed by the |
| 262 | +user application. Unlike when used as a work area for a process, you can not |
| 263 | +rely on things like language-level garbage collection. |
| 264 | +* The purpose of writing files to a volume is to save data or pass it between |
| 265 | +applications. Neither Kubernetes nor the OS may automatically delete files |
| 266 | +from a volume, so memory used by those files can not be reclaimed when the |
| 267 | +system or the pod are under memory pressure. |
| 268 | +* A memory-backed `emptyDir` is useful because of its performance, but memory |
| 269 | +is generally much smaller in size and much higher in cost than other storage |
| 270 | +media, such as disks or SSDs. Using large amounts of memory for `emptyDir` |
| 271 | +volumes may affect the normal operation of your pod or of the whole node, |
| 272 | +so should be used carefully. |
| 273 | + |
| 274 | +If you are administering a cluster or namespace, you can also set |
| 275 | +[ResourceQuota](/docs/concepts/policy/resource-quotas/) that limits memory use; |
| 276 | +you may also want to define a [LimitRange](/docs/concepts/policy/limit-range/) |
| 277 | +for additional enforcement. |
| 278 | +If you specify a `spec.containers[].resources.limits.memory` for each Pod, |
| 279 | +then the muximum size of an `emptyDir` volume will be the pod's memory limit. |
| 280 | + |
| 281 | +As an alternative, a cluster administrator can enforce size limits for |
| 282 | +`emptyDir` volumes in new Pods using a policy mechanism such as |
| 283 | +[ValidationAdmissionPolicy](/docs/reference/access-authn-authz/validating-admission-policy). |
| 284 | + |
240 | 285 | ## Local ephemeral storage
|
241 | 286 |
|
242 | 287 | <!-- feature gate LocalStorageCapacityIsolation -->
|
|
0 commit comments