diff --git a/roles/ceph-crash/templates/ceph-crash.service.j2 b/roles/ceph-crash/templates/ceph-crash.service.j2 index fd9468921..5343d02df 100644 --- a/roles/ceph-crash/templates/ceph-crash.service.j2 +++ b/roles/ceph-crash/templates/ceph-crash.service.j2 @@ -17,6 +17,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name ceph-crash-%i \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} +--pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --net=host \ -v /var/lib/ceph:/var/lib/ceph:z \ -v /etc/localtime:/etc/localtime:ro \ diff --git a/roles/ceph-grafana/templates/grafana-server.service.j2 b/roles/ceph-grafana/templates/grafana-server.service.j2 index 1fb57f316..da82bd586 100644 --- a/roles/ceph-grafana/templates/grafana-server.service.j2 +++ b/roles/ceph-grafana/templates/grafana-server.service.j2 @@ -22,6 +22,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name=grafana-server \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ -v /etc/grafana:/etc/grafana:Z \ -v /var/lib/grafana:/var/lib/grafana:Z \ --net=host \ diff --git a/roles/ceph-iscsi-gw/templates/rbd-target-api.service.j2 b/roles/ceph-iscsi-gw/templates/rbd-target-api.service.j2 index 7adc3b431..f480c7a07 100644 --- a/roles/ceph-iscsi-gw/templates/rbd-target-api.service.j2 +++ b/roles/ceph-iscsi-gw/templates/rbd-target-api.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_rbd_target_api_docker_memory_limit }} \ --cpus={{ ceph_rbd_target_api_docker_cpu_limit }} \ -v /etc/localtime:/etc/localtime:ro \ diff --git a/roles/ceph-iscsi-gw/templates/rbd-target-gw.service.j2 b/roles/ceph-iscsi-gw/templates/rbd-target-gw.service.j2 index 78397e126..0b3a04936 100644 --- a/roles/ceph-iscsi-gw/templates/rbd-target-gw.service.j2 +++ b/roles/ceph-iscsi-gw/templates/rbd-target-gw.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_rbd_target_gw_docker_memory_limit }} \ --cpus={{ ceph_rbd_target_gw_docker_cpu_limit }} \ -v /etc/localtime:/etc/localtime:ro \ diff --git a/roles/ceph-iscsi-gw/templates/tcmu-runner.service.j2 b/roles/ceph-iscsi-gw/templates/tcmu-runner.service.j2 index 6d9dc3bf7..d35917f87 100644 --- a/roles/ceph-iscsi-gw/templates/tcmu-runner.service.j2 +++ b/roles/ceph-iscsi-gw/templates/tcmu-runner.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_tcmu_runner_docker_memory_limit }} \ --cpus={{ ceph_tcmu_runner_docker_cpu_limit }} \ -v /etc/localtime:/etc/localtime:ro \ diff --git a/roles/ceph-mds/templates/ceph-mds.service.j2 b/roles/ceph-mds/templates/ceph-mds.service.j2 index c681146cb..54b2d7ac8 100644 --- a/roles/ceph-mds/templates/ceph-mds.service.j2 +++ b/roles/ceph-mds/templates/ceph-mds.service.j2 @@ -22,6 +22,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_mds_docker_memory_limit }} \ --cpus={{ cpu_limit }} \ -v /var/lib/ceph:/var/lib/ceph:z \ diff --git a/roles/ceph-mgr/templates/ceph-mgr.service.j2 b/roles/ceph-mgr/templates/ceph-mgr.service.j2 index 56c49c4a6..2cca6364b 100644 --- a/roles/ceph-mgr/templates/ceph-mgr.service.j2 +++ b/roles/ceph-mgr/templates/ceph-mgr.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_mgr_docker_memory_limit }} \ --cpus={{ ceph_mgr_docker_cpu_limit }} \ -v /var/lib/ceph:/var/lib/ceph:z,rshared \ diff --git a/roles/ceph-mon/templates/ceph-mon.service.j2 b/roles/ceph-mon/templates/ceph-mon.service.j2 index ed95cc60b..bdcc1063b 100644 --- a/roles/ceph-mon/templates/ceph-mon.service.j2 +++ b/roles/ceph-mon/templates/ceph-mon.service.j2 @@ -22,6 +22,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name ceph-mon-%i \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_mon_docker_memory_limit }} \ --cpus={{ ceph_mon_docker_cpu_limit }} \ -v /var/lib/ceph:/var/lib/ceph:z,rshared \ diff --git a/roles/ceph-nfs/templates/ceph-nfs.service.j2 b/roles/ceph-nfs/templates/ceph-nfs.service.j2 index f3e3ac4bf..e053788e8 100644 --- a/roles/ceph-nfs/templates/ceph-nfs.service.j2 +++ b/roles/ceph-nfs/templates/ceph-nfs.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ -v /var/lib/ceph:/var/lib/ceph:z \ -v /etc/ceph:/etc/ceph:z \ -v /var/lib/nfs/ganesha:/var/lib/nfs/ganesha:z \ diff --git a/roles/ceph-node-exporter/templates/node_exporter.service.j2 b/roles/ceph-node-exporter/templates/node_exporter.service.j2 index d3228a119..346c84e62 100644 --- a/roles/ceph-node-exporter/templates/node_exporter.service.j2 +++ b/roles/ceph-node-exporter/templates/node_exporter.service.j2 @@ -20,6 +20,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name=node-exporter \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --privileged \ -v /proc:/host/proc:ro -v /sys:/host/sys:ro \ --net=host \ diff --git a/roles/ceph-osd/templates/ceph-osd.service.j2 b/roles/ceph-osd/templates/ceph-osd.service.j2 index fb179dde5..75ea7195a 100644 --- a/roles/ceph-osd/templates/ceph-osd.service.j2 +++ b/roles/ceph-osd/templates/ceph-osd.service.j2 @@ -27,6 +27,7 @@ numactl \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --rm \ --net=host \ --privileged=true \ diff --git a/roles/ceph-prometheus/templates/alertmanager.service.j2 b/roles/ceph-prometheus/templates/alertmanager.service.j2 index 28280c3d6..a621c8a76 100644 --- a/roles/ceph-prometheus/templates/alertmanager.service.j2 +++ b/roles/ceph-prometheus/templates/alertmanager.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name=alertmanager \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ -v "{{ alertmanager_conf_dir }}:/etc/alertmanager:Z" \ -v "{{ alertmanager_data_dir }}:/alertmanager:Z" \ --net=host \ diff --git a/roles/ceph-prometheus/templates/prometheus.service.j2 b/roles/ceph-prometheus/templates/prometheus.service.j2 index 3f2ed5602..8202cf22e 100644 --- a/roles/ceph-prometheus/templates/prometheus.service.j2 +++ b/roles/ceph-prometheus/templates/prometheus.service.j2 @@ -20,6 +20,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --name=prometheus \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ -v "{{ prometheus_conf_dir }}:/etc/prometheus:Z" \ -v "{{ prometheus_data_dir }}:/prometheus:Z" \ --net=host \ diff --git a/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 b/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 index 48c0b3d17..c9e87acdd 100644 --- a/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 +++ b/roles/ceph-rbd-mirror/templates/ceph-rbd-mirror.service.j2 @@ -21,6 +21,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_rbd_mirror_docker_memory_limit }} \ --cpus={{ ceph_rbd_mirror_docker_cpu_limit }} \ -v /var/lib/ceph:/var/lib/ceph:z \ diff --git a/roles/ceph-rgw/templates/ceph-radosgw.service.j2 b/roles/ceph-rgw/templates/ceph-radosgw.service.j2 index 7c007e5bd..881b970ab 100644 --- a/roles/ceph-rgw/templates/ceph-radosgw.service.j2 +++ b/roles/ceph-rgw/templates/ceph-radosgw.service.j2 @@ -22,6 +22,7 @@ ExecStart=/usr/bin/{{ container_binary }} run --rm --net=host \ {% if container_binary == 'podman' %} -d --log-driver journald --conmon-pidfile /%t/%n-pid --cidfile /%t/%n-cid \ {% endif %} + --pids-limit={{ 0 if container_binary == 'podman' else -1 }} \ --memory={{ ceph_rgw_docker_memory_limit }} \ --cpus={{ cpu_limit }} \ {% if ceph_rgw_docker_cpuset_cpus is defined -%}