debian進程如何進行資源隔離

在Debian系統中，有多種方法可以進行進程資源隔離。以下是一些常見的方法：

1. 使用 cgroups（控制組）

cgroups 是 Linux 內核提供的一種機制，用于限制、記錄和隔離進程組的資源（CPU、內存、磁盤I/O等）。

安裝 cgroups 工具

sudo apt-get update
sudo apt-get install cgroup-tools

創建一個新的控制組

sudo cgcreate -g memory:/mygroup

設置內存限制

echo "100M" | sudo tee /sys/fs/cgroup/memory/mygroup/memory.limit_in_bytes

將進程添加到控制組

sudo cgclassify -g memory:mygroup <pid>

2. 使用 systemd 的 slice

systemd 提供了 slice 概念，可以用來隔離一組服務的資源。

創建一個新的 slice

sudo systemctl isolate myslice.slice

配置 slice 資源限制

編輯 /etc/systemd/system/myslice.slice 文件，添加資源限制配置：

[Slice]
MemoryLimit=100M
CPUQuota=50%

然后重新加載 systemd 配置并重啟 slice：

sudo systemctl daemon-reload
sudo systemctl restart myslice.slice

3. 使用 Docker

Docker 是一個流行的容器化平臺，可以用來隔離進程及其資源。

安裝 Docker

sudo apt-get update
sudo apt-get install docker.io

運行一個容器

sudo docker run -it --memory="100m" --cpus="1.0" ubuntu:latest /bin/bash

4. 使用 LXC（Linux Containers）

LXC 是一種輕量級的虛擬化技術，可以用來隔離進程。

安裝 LXC

sudo apt-get update
sudo apt-get install lxc

創建一個新的容器

sudo lxc-create -t download -n mycontainer -d ubuntu -- --dist ubuntu-bionic64

啟動容器

sudo lxc-start -n mycontainer

設置資源限制

編輯容器的配置文件 /var/lib/lxc/mycontainer/config，添加資源限制配置：

lxc.cgroup.devices.allow = a
lxc.mount.auto = proc:rw sys:rw
lxc.mount.auto = devpts:rw
lxc.mount.auto = tmpfs:rw
lxc.mount.auto = tmpfs:ro
lxc.mount.auto = tmpfs:suid
lxc.mount.auto = tmpfs:exec
lxc.mount.auto = tmpfs:dev
lxc.mount.auto = tmpfs:mnt
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto = tmpfs:sbin
lxc.mount.auto = tmpfs:bin
lxc.mount.auto = tmpfs:devpts
lxc.mount.auto = tmpfs:sysfs
lxc.mount.auto = tmpfs:proc
lxc.mount.auto = tmpfs:run
lxc.mount.auto = tmpfs:lock
lxc.mount.auto = tmpfs:ipc
lxc.mount.auto = tmpfs:usr
lxc.mount.auto = tmpfs:opt
lxc.mount.auto = tmpfs:srv
lxc.mount.auto = tmpfs:home
lxc.mount.auto = tmpfs:root
lxc.mount.auto = tmpfs:boot
lxc.mount.auto = tmpfs:etc
lxc.mount.auto = tmpfs:var
lxc.mount.auto = tmpfs:lib
lxc.mount.auto = tmpfs:lib64
lxc.mount.auto = tmpfs:usr/local
lxc.mount.auto