Documentation
¶
Overview ¶
Package capacity implements admission control for sandbox creation.
Admission is purely resource-math — there is no fixed "max sandboxes" number. The admitter combines two signals before letting a sandbox in:
- Sum-of-reservations against host CPU cores and total memory, scaled by configurable ratios. This is predictable: the operator knows that accepted requests will not collectively exceed the ratio of host capacity, regardless of whether the sandboxes are actually using it. A 64-core box can run 200 tiny sandboxes or 8 huge ones — whatever the math allows.
- A live free-memory floor read from /proc/meminfo. This catches the case where reservations look fine but the host is genuinely tight right now (e.g. another process is eating RAM).
Reservations are tracked in-process. They must be replayed at startup from persistent state so a daemon restart doesn't reset accounting to zero.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrCapacityExceeded = errors.New("host capacity exceeded")
ErrCapacityExceeded is returned by Admit when the host cannot accept a new sandbox. The wrapped error carries human-readable reasons; callers can use errors.Is to map this to a 503 response.
Functions ¶
This section is empty.
Types ¶
type Admitter ¶
type Admitter struct {
// contains filtered or unexported fields
}
Admitter is the thread-safe admission controller. Construct with New and keep a single instance per daemon.
func New ¶
New builds an admitter. host should reflect the machine's total capacity; callers that don't care about per-host detection can use DetectHost.
func (*Admitter) Admit ¶
Admit decides whether a new sandbox with the given resource request can be accepted right now. On success it reserves the request under sandboxID and returns nil. On failure it returns an error wrapping ErrCapacityExceeded with reasons attached; no reservation is made.
Callers that fail downstream (e.g. docker create errors) must call Release to free the reservation. Reserve is idempotent per sandboxID — re-admitting the same ID overwrites the prior reservation.
func (*Admitter) Release ¶
Release frees the reservation for sandboxID. Safe to call for unknown IDs.
type HostInfo ¶
type HostInfo struct {
CPUCores int
MemoryTotalMB int
// DiskTotalGB is the disk budget the operator declares for sandbox
// storage (the volume backing Docker's data root). Auto-detection is
// out of scope for Phase 1 — operators set SB_HOST_DISK_GB. 0 means
// no disk accounting.
DiskTotalGB int
// GPUCount and GPUVendor describe the GPU inventory the operator has
// wired up to Docker. Operator-declared (SB_HOST_GPU_COUNT /
// SB_HOST_GPU_VENDOR); 0 means no GPUs available.
GPUCount int
GPUVendor string
// SupportedRuntimes lists the OCI runtimes installed on this host.
// Empty defaults to []{"docker"} at Admitter construction so a node
// that doesn't set the field still admits the common case.
SupportedRuntimes []string
}
HostInfo describes the static host capacity.
func DetectHost ¶
DetectHost returns CPU core count from runtime and memory total from /proc/meminfo via the default probe. Callers may override either field.
type Limits ¶
type Limits struct {
// CPUReservationRatio is the maximum fraction of host CPU cores that may
// be reserved across all sandboxes. 0 = unlimited.
CPUReservationRatio float64
// MemoryReservationRatio is the maximum fraction of host memory that may
// be reserved across all sandboxes. 0 = unlimited.
MemoryReservationRatio float64
// DiskReservationRatio is the maximum fraction of host disk that may be
// reserved across all sandboxes. Disk is sized in GB rather than MB
// because Docker's --storage-opt size is GB-granular and operators
// reason about disk in GB. 0 = unlimited.
DiskReservationRatio float64
// MemoryFloorRatio is the minimum live MemAvailable the host must retain
// after admitting the request, expressed as a fraction of total host
// memory (e.g. 0.05 = keep at least 5% of RAM free). Expressing this as a
// ratio means a 16 GB laptop and a 256 GB box scale their headroom
// proportionally — a fixed MB floor would be either pointless on big
// hosts or starve small ones. 0 = no floor.
MemoryFloorRatio float64
// CPUOverProvisionFactor multiplies the CPU reservation budget. Docker
// --cpus is a CFS cap, not a hard reservation, so idle sandboxes share
// cores happily — a 10× default lets typical workloads pack densely.
// Values below 1.0 are clamped to 1.0 (no overcommit). 0 is treated as
// the default 1.0 so a zero-value Limits behaves as before.
CPUOverProvisionFactor float64
// MemoryOverProvisionFactor multiplies the memory reservation budget.
// Memory pressure is harder to recover from than CPU contention (OOM
// killer fires on hard limits), so the live MemoryFloorRatio check is
// the real backstop when this is set high. Same clamping as the CPU
// factor.
MemoryOverProvisionFactor float64
}
Limits configures the admitter. Zero values disable the corresponding check.
type MemProbe ¶
MemProbe reports live free memory in MB. The default implementation reads /proc/meminfo MemAvailable. Tests can substitute a fake.
func NewProcMeminfoProbe ¶
func NewProcMeminfoProbe() MemProbe
NewProcMeminfoProbe returns a MemProbe backed by /proc/meminfo with a 500ms cache. The cache window is small enough that decisions remain responsive to actual host memory pressure but large enough to absorb a burst of concurrent CreateSandbox calls without 50 file reads.
type Request ¶
type Request struct {
CPU float64
MemoryMB int
DiskGB int
GPUs int
GPUVendor string
Runtime string
}
Request is the per-sandbox resource ask, in normalized units. CPU is fractional cores (e.g. 0.5 = half a core); memory is whole MB; disk is whole GB. GPUs is the count requested (0 = no GPU); GPUVendor is the required vendor when GPUs > 0 and is matched against HostInfo.GPUVendor at admission/placement time. Runtime is the OCI runtime identifier ("docker", "gvisor", ...) — empty means "any runtime the host supports."
type Snapshot ¶
type Snapshot struct {
HostCPUCores int `json:"host_cpu_cores"`
HostMemoryTotalMB int `json:"host_memory_total_mb"`
HostDiskTotalGB int `json:"host_disk_total_gb,omitempty"`
ReservedCPU float64 `json:"reserved_cpu"`
ReservedMemoryMB int `json:"reserved_memory_mb"`
ReservedDiskGB int `json:"reserved_disk_gb,omitempty"`
ReservedGPUs int `json:"reserved_gpus,omitempty"`
LiveMemoryFreeMB int `json:"live_memory_free_mb"`
SandboxesActive int `json:"sandboxes_active"`
CanAdmit bool `json:"can_admit"`
Reasons []string `json:"reasons,omitempty"`
CPUReservationRatio float64 `json:"cpu_reservation_ratio"`
MemoryReservationRatio float64 `json:"memory_reservation_ratio"`
DiskReservationRatio float64 `json:"disk_reservation_ratio,omitempty"`
MemoryFloorRatio float64 `json:"memory_floor_ratio"`
CPUOverProvisionFactor float64 `json:"cpu_overprovision_factor"`
MemoryOverProvisionFactor float64 `json:"memory_overprovision_factor"`
// MemoryFloorMB is the absolute floor derived from MemoryFloorRatio and
// host memory, exposed for operators reading /capacity.
MemoryFloorMB int `json:"memory_floor_mb"`
// CPUBudget and MemoryBudgetMB are the post-overcommit budgets actually
// used by Admit, exposed so operators can see the effective ceiling.
CPUBudget float64 `json:"cpu_budget"`
MemoryBudgetMB int `json:"memory_budget_mb"`
DiskBudgetGB int `json:"disk_budget_gb,omitempty"`
// GPUCount and GPUVendor are static node attributes set by the operator
// (no auto-detection in Phase 1). Placement uses them to skip a peer
// that cannot satisfy a GPU sandbox at all — running the admitter
// remotely after a doomed forward would just 503.
GPUCount int `json:"gpu_count,omitempty"`
GPUVendor string `json:"gpu_vendor,omitempty"`
// SupportedRuntimes lists the OCI runtimes this host can run
// ("docker", "gvisor", ...). Used by placement to skip a peer that
// doesn't have, say, runsc installed. Empty = legacy node, treated as
// supporting any runtime so rolling upgrades don't strand pre-D peers.
SupportedRuntimes []string `json:"supported_runtimes,omitempty"`
}
Snapshot is a read-only view of admitter state, suitable for an HTTP /capacity response. It is also the payload that placement scoring reads off gossip — every field that is needed to decide "can this peer host this request?" must be present here, otherwise placement scores against stale assumptions and the caller fans out to a node that can't actually admit. See nodeMeta in internal/cluster/gossip.go for the size budget.