#!/usr/bin/env bash # # JbTecWiz Support Centre -- generated fix script # # Fault : A container keeps restarting -- exit code 137, 139 or 1 # Fix : Establish whether the limit is too low or the application leaks # Source: https://jbtecwiz.com/support/lnx-ctr-exit137 # # Run as : Root shell # Expect : 40 minutes # Risk : medium # Reversible : yes # # WHEN THIS IS THE RIGHT FIX # 137, or the state shows OOMKilled. # # HOW TO UNDO IT # docker update with the previous values. # # Walks the fix one step at a time and asks before each. Steps with no # command are yours to do -- it prints those and waits. DRYRUN=1 prints # without executing; UNATTENDED=1 does not ask. # # -------------------------------------------------------------------- # NO WARRANTY - USE AT YOUR OWN RISK # # This script is provided by JbTecWiz as-is and with no warranty of any # kind, express or implied. You run it entirely at your own risk. # # JbTecWiz accepts no liability for any loss or damage arising from its # use, including but not limited to data loss, downtime, or configuration # changes that turn out to be wrong for your system. # # You are responsible for reading this script before running it, for # satisfying yourself that it suits the machine in front of you, and for # having a working backup first. Some steps cannot be undone. # -------------------------------------------------------------------- set -uo pipefail DRYRUN="${DRYRUN:-0}" UNATTENDED="${UNATTENDED:-0}" failed=0 if [ "$(id -u)" -ne 0 ]; then echo " This fix is documented as needing root. Re-run with sudo." >&2 exit 3 fi rule() { printf "\n%s\n" "$(printf '-%.0s' $(seq 1 70))"; if [ $# -gt 0 ]; then echo "$1"; fi; } prose() { echo "$1" | fold -s -w 74 | sed "s/^/ /"; } # Returns 0 when the caller should run the command, 1 when it should not. # A manual step always returns 1 -- there is nothing for the caller to run. step() { # step [command lines...] local n="$1" dotext="$2" why="$3" mode="$4"; shift 4 rule " Step $n of 6" prose "$dotext" if [ -n "$why" ]; then echo; prose "$why"; fi if [ "$mode" = "manual" ]; then echo; echo " -> Do this yourself, then press Enter to carry on." if [ "$UNATTENDED" = "0" ] && [ "$DRYRUN" = "0" ]; then read -r _; fi return 1 fi echo; printf " %s\n" "$@"; echo if [ "$DRYRUN" = "1" ]; then echo " (dry run -- not executed)"; return 1; fi if [ "$UNATTENDED" = "0" ]; then read -r -p " Run this step? [Y]es / [S]kip / [Q]uit " a case "$a" in [Qq]*) echo " Stopped at your request."; exit 0 ;; [Ss]*) echo " Skipped."; return 1 ;; esac fi return 0 } rule echo " A container keeps restarting -- exit code 137, 139 or 1" echo " Establish whether the limit is too low or the application leaks" echo echo " Risk: medium Reversible 40 minutes" echo prose 'No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.' rule echo if [ "$UNATTENDED" = "0" ] && [ "$DRYRUN" = "0" ]; then read -r -p " Ready? [y/N] " go case "$go" in [Yy]*) ;; *) echo " Nothing was changed."; exit 0;; esac fi if step 1 'Confirm it was the memory limit rather than the host running out.' 'A container killed by its own cgroup limit and a container killed because the host ran out of memory look identical from the outside and need opposite fixes -- one is a limit that is too low, the other is a host that is over-committed.' cmd 'docker inspect --format '\''{{.State.OOMKilled}} {{.State.ExitCode}} {{.HostConfig.Memory}}'\'' mycontainer' 'dmesg -T | grep -i '\''killed process'\'' | tail'; then docker inspect --format '{{.State.OOMKilled}} {{.State.ExitCode}} {{.HostConfig.Memory}}' mycontainer dmesg -T | grep -i 'killed process' | tail if [ $? -ne 0 ]; then failed=$((failed+1)) echo " Step 1 failed. The rest of the fix may depend on it." >&2 fi fi if step 2 'Watch its usage against the limit before changing anything.' '' cmd 'docker stats --no-stream'; then docker stats --no-stream if [ $? -ne 0 ]; then failed=$((failed+1)) echo " Step 2 failed. The rest of the fix may depend on it." >&2 fi fi step 3 'If usage climbs steadily and never falls, it is a leak in the application and raising the limit only lengthens the interval between restarts.' '' manual || true if step 4 'For a JVM or Node application, make sure the runtime knows about the container limit -- by default many runtimes read the host'\''s total memory and size their heap for that.' 'This is a specific and extremely common cause: a JVM in a 512MB container sizing its heap against a 64GB host, then being killed the moment it grows into it.' cmd 'docker run -e JAVA_OPTS='\''-XX:MaxRAMPercentage=75'\'' myimage'; then docker run -e JAVA_OPTS='-XX:MaxRAMPercentage=75' myimage if [ $? -ne 0 ]; then failed=$((failed+1)) echo " Step 4 failed. The rest of the fix may depend on it." >&2 fi fi if step 5 'Set a limit that reflects measured usage plus headroom.' '' cmd 'docker update --memory 1g --memory-swap 1g mycontainer'; then docker update --memory 1g --memory-swap 1g mycontainer if [ $? -ne 0 ]; then failed=$((failed+1)) echo " Step 5 failed. The rest of the fix may depend on it." >&2 fi fi if step 6 'In Kubernetes, set requests and limits together and keep them close for predictable scheduling.' '' cmd 'kubectl describe pod mypod | grep -A5 -E '\''Limits|Requests|Last State'\'''; then kubectl describe pod mypod | grep -A5 -E 'Limits|Requests|Last State' if [ $? -ne 0 ]; then failed=$((failed+1)) echo " Step 6 failed. The rest of the fix may depend on it." >&2 fi fi rule " Confirm it worked" prose 'The container runs for a full day without restarting and usage plateaus below the limit.' if [ "$DRYRUN" = "0" ]; then docker ps --format 'table {{.Names}}\t{{.Status}}' fi rule if [ "$failed" -gt 0 ]; then echo " Finished with $failed failed step(s)." echo " Read the full write-up at https://jbtecwiz.com/support/lnx-ctr-exit137" else echo " Finished." fi echo prose 'To undo: docker update with the previous values.' rule