In this lesson, you will learn how to enforce hard disk space limits on container storage by leveraging project-based filesystem quotas on XFS or ext4.
While Cgroups manage CPU and memory, they do not inherently restrict the amount of disk space a container consumes within a layered filesystem like OverlayFS. If a container process writes logs or data until the host’s root partition is full, the entire host might crash. To prevent this, we use filesystem-level quotas.
Project Quotas: The Mechanism
Project quotas are superior to traditional user or group quotas for containers because they allow you to group multiple files and directories under a single "Project ID." You can assign a unique ID to each container's storage directory on the host. Even if the container runs as root, the filesystem tracks the blocks allocated to that Project ID regardless of who created the files.
Configuration Workflow
To enable this on an XFS partition, you must mount it with the pquota option. Once mounted, you can associate a directory with a project ID and set a limit:
# 1. Mount the filesystem with project quotas
mount -o pquota /dev/sdb /var/lib/container-storage
# 2. Define a project ID for a specific container path
echo "1001:/var/lib/container-storage/my-container" >> /etc/projects
# 3. Map the project name to the ID
echo "my-container:1001" >> /etc/projid
# 4. Enforce the limit (e.g., 5GB hard limit)
xfs_quota -x -c 'limit -p bhard=5g 1001' /var/lib/container-storage
Why it Matters
When the container's storage driver writes files to the OverlayFS upperdir or workdir, the filesystem checks the project quota associated with that inode. Once the limit is reached, the kernel returns an EDQUOT error to the container process. This ensures that the container's "noisy neighbor" behavior is contained within its own storage sandbox, preventing it from exhausting host-wide storage resources. By moving quota enforcement into the filesystem layer, you provide a robust, immutable constraint that is independent of the container runtime’s own configuration.
Key Takeaway: Project quotas allow you to enforce strict disk space limits on specific container storage directories by tagging files with a unique identifier that the kernel respects, regardless of the container's internal UID.