Control Groups示例

Example 1

/etc/cgconfig.conf配置文件内容如下:

              mount {

                     cpu = /mnt/cgroups/cpu;

                     cpuacct = /mnt/cgroups/cpu;

              }

创建由cpu/cpuacct两个子系统控制的层次结构，内部不包含groups。对应的shell操作如下:

              mkdir /mnt/cgroups/cpu

              mount -t cgroup -o cpu,cpuacct cpu /mnt/cgroups/cpu

Example 2

/etc/cgconfig.conf配置文件内容如下:

              mount {

                     cpu = /mnt/cgroups/cpu;

                     cpuacct = /mnt/cgroups/cpu;

              }

              group daemons/www {

                     perm {

                             task {

                                    uid = root;

                                    gid = webmaster;

                             }

                             admin {

                                    uid = root;

                                    gid = root;

                             }

                     }

                     cpu {

                             cpu.shares = "1000";

                     }

              }

              group daemons/ftp {

                     perm {

                             task {

                                    uid = root;

                                    gid = ftpmaster;

                             }

                             admin {

                                    uid = root;

                                    gid = root;

                             }

                     }

                     cpu {

                             cpu.shares = "500";

                     }

              }

      创建由cpu/cpuacct两个子系统控制的层次结构，其中包含一个daemons组和www/ftp两个子组，设置一个cpu.shares的参数。对应的shell操作如下:

              mkdir /mnt/cgroups/cpu

              mount -t cgroup -o cpu,cpuacct cpu /mnt/cgroups/cpu

              mkdir /mnt/cgroups/cpu/daemons

              mkdir /mnt/cgroups/cpu/daemons/www

              chown root:root /mnt/cgroups/cpu/daemons/www/*

              chown root:webmaster /mnt/cgroups/cpu/daemons/www/tasks

              echo 1000 > /mnt/cgroups/cpu/daemons/www/cpu.shares

              mkdir /mnt/cgroups/cpu/daemons/ftp

              chown root:root /mnt/cgroups/cpu/daemons/ftp/*

              chown root:ftpmaster /mnt/cgroups/cpu/daemons/ftp/tasks

              echo 500 > /mnt/cgroups/cpu/daemons/ftp/cpu.shares

在创建第一个www子组时，自动创建daemons组。它的所有参数都是默认值，只有root用户可以访问daemons组的文件。

由于cpuacct和cpu子系统都挂载到同一个目录，所以所有组也都由cpuacct子系统隐式控制，即使在任何组中都没有cpuacct节。

permissions给定控制组对所安装的文件系统的权限。Root总是有权限对控制组做任何事情。permissions有以下语法:

perm {

            task {

                   uid = <task user>;

                   gid = <task group>;

            }

            admin {

                   uid = <admin name>;

                   gid = <admin group>;

            }

     }

task user/group：拥有指定允许向tasks文件分配任务的的用户名和组名。也就是说，这个用户和这个组的成员对tasks文件有写访问权。

admin user/group：拥有控制组其余文件的用户名和组名。这些用户可以设置子系统参数和创建子组。

Example 3

/etc/cgconfig.conf配置文件内容如下:

              mount {

                     cpu = /mnt/cgroups/cpu;

                     cpuacct = /mnt/cgroups/cpuacct;

              }

              group daemons {

                     cpuacct{

                     }

                     cpu {

                     }

              }

 在cpu/cpuacct两个层次结构中创建一个公共组。对应的操作如下:

              mkdir /mnt/cgroups/cpu

              mkdir /mnt/cgroups/cpuacct

              mount -t cgroup -o cpu cpu /mnt/cgroups/cpu

              mount -t cgroup -o cpuacct cpuacct /mnt/cgroups/cpuacct

              mkdir /mnt/cgroups/cpu/daemons

              mkdir /mnt/cgroups/cpuacct/daemons

事实上，有两个组被创建。一个在cpuacct层次中，第二个在cpu层次中。这两个组没有任何共同点，可以包含不同的subgroups和不同的tasks。

Example 4

/etc/cgconfig.conf配置文件内容如下:

              mount {

                     cpu = /mnt/cgroups/cpu;

                     cpuacct = /mnt/cgroups/cpuacct;

              }

              group daemons {

                     cpuacct{

                     }

              }

              group daemons/www {

                     cpu {

                             cpu.shares = "1000";

                     }

              }

              group daemons/ftp {

                     cpu {

                             cpu.shares = "500";

                     }

              }

创建cpu/cpuacct两个层次结构，其中包含一些的组。在两个层次结构中都创建一个组。 对应的shell操作如下:

              mkdir /mnt/cgroups/cpu

              mkdir /mnt/cgroups/cpuacct

              mount -t cgroup -o cpu cpu /mnt/cgroups/cpu

              mount -t cgroup -o cpuacct cpuacct /mnt/cgroups/cpuacct

              mkdir /mnt/cgroups/cpuacct/daemons

              mkdir /mnt/cgroups/cpu/daemons

              mkdir /mnt/cgroups/cpu/daemons/www

              echo 1000 > /mnt/cgroups/cpu/daemons/www/cpu.shares

              mkdir /mnt/cgroups/cpu/daemons/ftp

              echo 500 > /mnt/cgroups/cpu/daemons/ftp/cpu.shares

在两个层次结构中都创建了daemons组。在cpuacct层次结构中，组在配置文件中显式地提到。在cpu层次结构中，是www创建时隐式创建的组。这两个组没有任何共同之处，例如，它们不共享流程和子组。组www和ftp只在cpu层次结构中创建，不受cpuacct子系统控制。

Example 5

group的名称只能包含字符，这是目录名所允许的。这些组组成一个树，即一个控制组可以包含零个或多个子组。子组可以使用' / '分隔符指定。

root控制组总是在所有层次结构中自动创建，它是组层次结构的基础。可以在cgconfig.conf文件中使用“.”(点)作为组名显式指定。这可以用来设置它的权限，如下示例所示。

/etc/cgconfig.conf配置文件内容如下:

              mount {

                     cpu = /mnt/cgroups/cpu;

                     cpuacct = /mnt/cgroups/cpu;

              }

              group . {

                     perm {

                             task {

                                    uid = root;

                                    gid = operator;

                             }

                             admin {

                                    uid = root;

                                    gid = operator;

                             }

                     }

                     cpu {

                     }

              }

              group daemons {

                     perm {

                             task {

                                    uid = root;

                                    gid = daemonmaster;

                             }

                             admin {

                                    uid = root;

                                    gid = operator;

                             }

                     }

                     cpu {

                     }

              }

创建由两个子系统控制的层次结构，其中一个组具有一些特殊权限。对应的shell操作如下:

              mkdir /mnt/cgroups/cpu

              mount -t cgroup -o cpu,cpuacct cpu /mnt/cgroups/cpu

              chown root:operator /mnt/cgroups/cpu/*

              chown root:operator /mnt/cgroups/cpu/tasks

              mkdir /mnt/cgroups/cpu/daemons

              chown root:operator /mnt/cgroups/cpu/daemons/*

              chown root:daemonmaster /mnt/cgroups/cpu/daemons/tasks

作为operator组成员的用户被允许管理control groups，即创建新的control groups，并且可以在这些组之间移动进程，而不需要root权限。

daemonmaster组的成员可以将进程移动到daemons control groups中，但不能将进程移出该组。只有operator或root可以这样做。