mirror of
https://github.com/linuxkit/linuxkit.git
synced 2025-10-31 09:37:21 +00:00
d4b23a76de
We already had this increased above the defaults, but even larger values seem to be recommended. See https://blog.openai.com/scaling-kubernetes-to-2500-nodes/ "It’s common to tune this setting in HPC clusters, and is particularly relevant in Kubernetes clusters since every pod has its own IP address which consumes space in the ARP cache." Signed-off-by: Justin Cormack <justin.cormack@docker.com>
32 lines
990 B
Plaintext
32 lines
990 B
Plaintext
# from Alpine defaults
|
|
net.ipv4.tcp_syncookies = 1
|
|
net.ipv4.conf.default.rp_filter = 1
|
|
net.ipv4.conf.all.rp_filter = 1
|
|
net.ipv4.ping_group_range=999 59999
|
|
# general limits
|
|
vm.max_map_count = 262144
|
|
vm.overcommit_memory = 1
|
|
net.core.somaxconn = 1024
|
|
net.ipv4.neigh.default.gc_thresh1 = 80000
|
|
net.ipv4.neigh.default.gc_thresh2 = 90000
|
|
net.ipv4.neigh.default.gc_thresh3 = 100000
|
|
fs.aio-max-nr = 1048576
|
|
fs.inotify.max_user_watches = 524288
|
|
fs.file-max = 524288
|
|
# for rngd
|
|
kernel.random.write_wakeup_threshold = 3072
|
|
# security restrictions
|
|
kernel.kptr_restrict = 2
|
|
net.ipv4.conf.all.send_redirects = 0
|
|
net.ipv4.conf.default.accept_redirects = 0
|
|
net.ipv4.conf.default.accept_source_route = 0
|
|
net.ipv6.conf.all.accept_redirects = 0
|
|
net.ipv6.conf.default.accept_redirects = 0
|
|
kernel.dmesg_restrict = 1
|
|
kernel.perf_event_paranoid = 3
|
|
fs.protected_hardlinks = 1
|
|
fs.protected_symlinks = 1
|
|
# Prevent ebpf privilege escalation
|
|
# see: https://lwn.net/Articles/742170
|
|
kernel.unprivileged_bpf_disabled=1
|