[SOLVED] Docker Container JVM not picking up cgroups memory limit

Docker Container JVM not picking up cgroups memory limit

OS: CachyOS (Arch-based Linux Distro)

Docker Version: 28.1.1

Cgroup Driver: systemd

Cgroup Version: 2

Why isn't the JVM running inside the container picking the memory limits as I would expect? If I run

docker run --rm -m 1gb public.ecr.aws/amazoncorretto/amazoncorretto:24 java -XshowSettings:vm -version

This is the result:

VM settings:
    Max. Heap Size (Estimated): 15.68G
    Using VM: OpenJDK 64-Bit Server VM

openjdk version "24.0.1" 2025-04-15
OpenJDK Runtime Environment Corretto-24.0.1.9.1 (build 24.0.1+9-FR)
OpenJDK 64-Bit Server VM Corretto-24.0.1.9.1 (build 24.0.1+9-FR, mixed mode, sharing)

16GB of RAM (25% of my host) is being presented to my container or the JVM somehow isn't picking up the restrictions.

With this command I would expect to see atmost 250MB of Max Heap Size, but the restrictions are not working.

Any idea on how to fix it?

EDIT

After testing on a AWS EC2 instance, worked as expected:

[ec2-user@ip-172-31-47-20 ~]$ docker run --rm -m 1gb public.ecr.aws/amazoncorretto/amazoncorretto:24 java -XshowSettings:vm -version
VM settings:
    Max. Heap Size (Estimated): 247.50M
    Using VM: OpenJDK 64-Bit Server VM

openjdk version "24.0.1" 2025-04-15
OpenJDK Runtime Environment Corretto-24.0.1.9.1 (build 24.0.1+9-FR)
OpenJDK 64-Bit Server VM Corretto-24.0.1.9.1 (build 24.0.1+9-FR, mixed mode, sharing)

I really don't understand why it does not work on my personal computer. My best guess is that it is some limitation of the Distro I'm using or something wrong with my Docker installation or something wrong with my cgroup configurations.

EDIT 2

Adding -Xlog:os+container=trace outputs this:

docker run --rm -m 1g public.ecr.aws/amazoncorretto/amazoncorretto:24 java -Xlog:os+container=trace -XshowSettings:vm -version
[0.003s][trace][os,container] OSContainer::init: Initializing Container Support
[0.003s][debug][os,container] Detected optional pids controller entry in /proc/cgroups
[0.003s][debug][os,container] controller cpuset is not enabled
[                           ]
[0.003s][debug][os,container] controller memory is not enabled
[                           ]
[0.003s][debug][os,container] One or more required controllers disabled at kernel level.
VM settings:
    Max. Heap Size (Estimated): 15.68G
    Using VM: OpenJDK 64-Bit Server VM

openjdk version "24.0.1" 2025-04-15
OpenJDK Runtime Environment Corretto-24.0.1.9.1 (build 24.0.1+9-FR)
OpenJDK 64-Bit Server VM Corretto-24.0.1.9.1 (build 24.0.1+9-FR, mixed mode, sharing)

Well this might be a hint. cgroups memory controller is not enabled (maybe something related to systemd controllers???)

Solution

You are affected by the JVM bug JDK-8347811.

In short, JVM uses /proc/cgroups to find available cgroup controllers, even though it is deprecated in cgroup v2.

Linux Kernel 6.12 includes a change that makes /proc/cgroups no longer usable for this purpose, causing "controller is not enabled" errors in JVM logs.

The bug has been fixed in JDK 25.
A workaround suggested here is to rebuild kernel with CONFIG_CPUSETS_V1=y.