This question already has an answer here:

I'm using unattended upgrades to patch about 300 ubuntu (16.04 LTS) machines (network appliances really), some are 1 CPU VMs running on ESXi, azure and AWS and others bare-metal quad core Atom IOT devices. I haven't experienced this issues on the bare-metal machines, but on the VM's, which are powered just enough to do what they need to do, when the machines patch themselves our SNMP monitoring goes nuts and we get high CPU spikes, swap memory alerts, etc..

Rather than work in ways to suppress these alerts (which is not what I'm asking about), are there any ways to let renice patching and just let it take its time patching? I wouldn't mind if it took 4 hours to patch, unattended that is (I wouldn't want to have patching go that slowly if I kicked it off with ansible or apt directly).

marked as duplicate by Fabby, Eric Carvalho, waltinator, cmak.fr, Kulfy Aug 11 at 8:00

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


I think this answer contains everything you are looking for:

OK, I managed myself to do the same you did, but with some changes:

1) I installed the same utilities:

sudo apt-get install cgroup-bin cgroup-lite cgroup-tools cgroupfs-mount libcgroup1

2) I edited conf files like this:

sudo -H gedit /etc/init/cgroup-lite.conf

description "mount available cgroup filesystems"
author "Serge Hallyn <serge.hallyn@canonical.com>"

start on mounted MOUNTPOINT=/sys/fs/cgroup

pre-start script
test -x /bin/cgroups-mount || { stop; exit 0; }
test -d /sys/fs/cgroup || { stop; exit 0; }
cgconfigparser -l /etc/cgconfig.conf
end script

post-stop script
if [ -x /bin/cgroups-umount ]
end script

sudo -H gedit /etc/cgconfig.conf

# Since systemd is working well, this section may not be necessary.
# Uncomment if you need it
# mount {
# cpuacct = /cgroup/cpuacct;
# memory = /cgroup/memory;
# devices = /cgroup/devices;
# freezer = /cgroup/freezer;
# net_cls = /cgroup/net_cls;
# blkio = /cgroup/blkio;
# cpuset = /cgroup/cpuset;
# cpu = /cgroup/cpu;
# }

group limitcpu{
  cpu {
    cpu.shares = 400;

group limitmem{
  memory {
    memory.limit_in_bytes = 512m;

group limitio{
  blkio {
    blkio.throttle.read_bps_device = "252:0         2097152";

group browsers {
    cpu {
#       Set the relative share of CPU resources equal to 25%
    cpu.shares = "256";
memory {
#       Allocate at most 512M of memory to tasks
        memory.limit_in_bytes = "512m";
#       Apply a soft limit of 512 MB to tasks
        memory.soft_limit_in_bytes = "384m";

group media-players {
    cpu {
#       Set the relative share of CPU resources equal to 25%
        cpu.shares = "256";
    memory {
#       Allocate at most 256M of memory to tasks
        memory.limit_in_bytes = "256m";
#       Apply a soft limit of 196 MB to tasks
        memory.soft_limit_in_bytes = "128m";

cgconfigparser -l /etc/cgconfig.conf

sudo -H gedit /etc/cgrules.conf

user:process                                         subsystems   group
[user]:/usr/lib/chromium-browser/chromium-browser   cpu,memory      browsers
[user]:/usr/bin/clementine                        cpu,memory     media-players

Note: This section needs to be updated with /usr/bin/apt

That is an example, use your username instead of [user]. You can add the applications you need to limit and define whether you want them to be CPU-, memory- or both limited.

I edited the GRUB_CMDLINE_LINUX_DEFAULT line in /etc/default/grub:

GRUB_CMDLINE_LINUX_DEFAULT="cgroup_enable=memory swapaccount=1"

Updating it:

sudo update-grub

3) And finally rebooting to apply changes.

And that is how I've got this working. Before this I was having frequent OOMs with multitasking - with chromium-browser, clementine, sublime-text and other applications using a lot of resources -, now they are running smoothly and I can multitask better.

Additional cgroups resources:

Not the answer you're looking for? Browse other questions tagged or ask your own question.