{"id":618,"date":"2026-10-04T12:00:00","date_gmt":"2026-10-04T12:00:00","guid":{"rendered":"https:\/\/konteynerium.com\/index.php\/2026\/10\/04\/container-kaynak-limitleri-memory-cpu-pids-oom\/"},"modified":"2026-10-04T12:00:00","modified_gmt":"2026-10-04T12:00:00","slug":"container-kaynak-limitleri-memory-cpu-pids-oom","status":"publish","type":"post","link":"https:\/\/konteynerium.com\/index.php\/2026\/10\/04\/container-kaynak-limitleri-memory-cpu-pids-oom\/","title":{"rendered":"Container Kaynak Limitleri: Bellek, CPU, PID ve OOM Davran\u0131\u015f\u0131"},"content":{"rendered":"

Varsay\u0131lan olarak bir container, host’un bellek ve CPU’sunun tamam\u0131n\u0131 kullanabilir. Bu, tek bir kontrolden \u00e7\u0131km\u0131\u015f container’\u0131n (bellek s\u0131z\u0131nt\u0131s\u0131, sonsuz d\u00f6ng\u00fc, fork bombas\u0131) ayn\u0131 makinedeki t\u00fcm di\u011fer<\/em> servisleri \u00e7\u00f6kertebilece\u011fi anlam\u0131na gelir. Kaynak limitleri, bir container’\u0131n ne kadar kullanabilece\u011fini s\u0131n\u0131rlayarak hasar\u0131 kendi i\u00e7inde tutar. Bu yaz\u0131da bellek, CPU ve s\u00fcre\u00e7 say\u0131s\u0131 limitlerini, a\u015f\u0131ld\u0131klar\u0131nda ne oldu\u011funu ger\u00e7ek \u00e7\u0131kt\u0131larla g\u00f6steriyoruz.<\/p>\n

Temel bayraklar<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n
Bayrak<\/th>\nNe yapar?<\/th>\n<\/tr>\n<\/thead>\n
--memory<\/code> \/ -m<\/code><\/td>\nSert bellek s\u0131n\u0131r\u0131 (en az 6 MB). A\u015f\u0131l\u0131rsa s\u00fcre\u00e7 \u00f6ld\u00fcr\u00fcl\u00fcr<\/td>\n<\/tr>\n
--memory-swap<\/code><\/td>\nBellek + swap toplam\u0131. --memory<\/code> ile ayn\u0131 de\u011fer = swap kullan\u0131m\u0131 yok<\/td>\n<\/tr>\n
--memory-reservation<\/code><\/td>\nYumu\u015fak s\u0131n\u0131r; yaln\u0131zca host’ta bellek s\u0131k\u0131\u015f\u0131kl\u0131\u011f\u0131 oldu\u011funda devreye girer, garanti vermez<\/td>\n<\/tr>\n
--cpus<\/code><\/td>\nKullan\u0131labilecek CPU miktar\u0131 (\u00f6rn. 0.5<\/code> = yar\u0131m \u00e7ekirdek)<\/td>\n<\/tr>\n
--cpu-shares<\/code><\/td>\nCPU s\u0131k\u0131\u015f\u0131kl\u0131\u011f\u0131nda g\u00f6reli a\u011f\u0131rl\u0131k (sert s\u0131n\u0131r de\u011fil)<\/td>\n<\/tr>\n
--cpuset-cpus<\/code><\/td>\nContainer’\u0131 belirli \u00e7ekirdeklere sabitler<\/td>\n<\/tr>\n
--pids-limit<\/code><\/td>\nContainer i\u00e7inde en fazla ka\u00e7 s\u00fcre\u00e7 olabilece\u011fi<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Limit koyup do\u011frulamak<\/h2>\n
docker run -d --name lim \\\n  --memory=64m --memory-swap=64m --memory-reservation=32m \\\n  --cpus=0.5 --pids-limit=20 \\\n  imaj sleep 120\n\n$ docker inspect lim --format 'Memory={{.HostConfig.Memory}} Swap={{.HostConfig.MemorySwap}} NanoCpus={{.HostConfig.NanoCpus}} Pids={{.HostConfig.PidsLimit}}'\nMemory=67108864 Swap=67108864 NanoCpus=500000000 Pids=20\n\n$ docker stats --no-stream lim\nlim  mem=656KiB \/ 64MiB  cpu=0.00%  pids=1<\/code><\/pre>\n
docker stats<\/code> \u00e7\u0131kt\u0131s\u0131ndaki \/ 64MiB<\/code>, limitin ger\u00e7ekten uyguland\u0131\u011f\u0131n\u0131 g\u00f6sterir. Limitlerin \u00e7ekirdekte nas\u0131l g\u00f6r\u00fcnd\u00fc\u011f\u00fcne bakmak isterseniz, container i\u00e7indeki cgroup dosyalar\u0131 de\u011ferleri do\u011frular. Denedi\u011fimiz ortamda (cgroup v1) memory.limit_in_bytes<\/code> 67108864<\/code> ve pids.max<\/code> 20<\/code> okundu. Modern Linux da\u011f\u0131t\u0131mlar\u0131n\u0131n \u00e7o\u011funda kullan\u0131lan cgroup v2’de ayn\u0131 bilgi \/sys\/fs\/cgroup\/memory.max<\/code> ve pids.max<\/code> dosyalar\u0131ndad\u0131r.<\/p>\n
\n  i<\/span><\/p>\n
Bu denemeyi yapt\u0131\u011f\u0131m\u0131z Docker 29.4 ortam\u0131 cgroup v1 \u00fczerindeydi ve Docker “cgroup v1 deste\u011fi kullan\u0131mdan kald\u0131r\u0131lm\u0131\u015ft\u0131r, en ge\u00e7 May\u0131s 2029’a kadar kald\u0131r\u0131lacakt\u0131r” uyar\u0131s\u0131 verdi. Yeni kurulumlarda cgroup v2 beklemelisiniz.<\/p>\n<\/div>\n
Bellek limiti a\u015f\u0131l\u0131nca: OOM<\/h2>\n
Container belle\u011fi sert s\u0131n\u0131r\u0131n\u0131 a\u015farsa \u00e7ekirde\u011fin OOM (out-of-memory) mekanizmas\u0131 s\u00fcreci \u00f6ld\u00fcr\u00fcr. Bunu 16 MB s\u0131n\u0131r\u0131 olan bir container’da ~40 MB’l\u0131k bir de\u011fi\u015fken olu\u015fturarak tetikledik:<\/p>\n
$ docker run --name oom --memory=16m --memory-swap=16m imaj sh -c 'x=$(head -c 40000000 \/dev\/zero | tr \"\\0\" \"a\"); echo ${#x}'\n$ echo $?\n137\n\n$ docker inspect oom --format 'OOMKilled={{.State.OOMKilled}} ExitCode={{.State.ExitCode}}'\nOOMKilled=true ExitCode=137<\/code><\/pre>\n
\u00c7\u0131k\u0131\u015f kodu 137<\/strong> (128 + SIGKILL 9) ve OOMKilled=true<\/code> \u2014 bir container’\u0131n “sebepsiz” s\u00fcrekli yeniden ba\u015flad\u0131\u011f\u0131n\u0131 g\u00f6r\u00fcrseniz ilk bakaca\u011f\u0131n\u0131z yer budur. Uygulaman\u0131n ger\u00e7ek bellek ihtiyac\u0131n\u0131 \u00f6l\u00e7\u00fcn (docker stats<\/code>) ve limiti buna g\u00f6re, biraz pay b\u0131rakarak ayarlay\u0131n; \u00e7ok d\u00fc\u015f\u00fck limit servis kesintisi, \u00e7ok y\u00fcksek limit koruma kayb\u0131 demektir.<\/p>\n
S\u00fcre\u00e7 limiti: fork bombas\u0131na kar\u015f\u0131<\/h2>\n
--pids-limit<\/code>, bir container’\u0131n s\u0131n\u0131rs\u0131z s\u00fcre\u00e7 \u00fcretmesini engeller. Limit 5 iken sekiz arka plan s\u00fcreci ba\u015flatmay\u0131 denedi\u011fimizde kabuk \u015funu s\u00f6yledi:<\/p>\n
$ docker run --rm --pids-limit=5 imaj sh -c 'for i in 1 2 3 4 5 6 7 8; do sleep 5 & done'\n\/bin\/sh: 0: Cannot fork<\/code><\/pre>\n
Limit a\u015f\u0131l\u0131nca yeni s\u00fcre\u00e7 olu\u015fturulam\u0131yor; b\u00f6ylece bir fork bombas\u0131 host’u de\u011fil yaln\u0131zca kendi container’\u0131n\u0131 t\u0131kar.<\/p>\n
Compose’ta limitler<\/h2>\n
services:\n  api:\n    image: uygulama:1\n    deploy:\n      resources:\n        limits:\n          cpus: \"0.5\"\n          memory: 256M\n        reservations:\n          memory: 128M\n    pids_limit: 200<\/code><\/pre>\n
Bu tan\u0131mlar Compose’un deploy.resources<\/code> b\u00f6l\u00fcm\u00fcndeki limit ve rezervasyonlara kar\u015f\u0131l\u0131k gelir. Docker Swarm ve Kubernetes’te de benzer kavramlar vard\u0131r (Kubernetes’te resources.requests\/limits<\/code>), bkz. Kubernetes Temelleri<\/a>.<\/p>\n
Pratik \u00f6neriler<\/h2>\n