add flag oom-kill-disable

README.md

@@ -396,6 +396,7 @@ Cgroup flags:
 - :whale: `--cpuset-cpus`: CPUs in which to allow execution (0-3, 0,1)
 - :whale: `--cpuset-mems`: Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on NUMA systems
 - :whale: `--memory`: Memory limit
+- :whale: `--oom-kill-disable`: Disable OOM Killer
 - :whale: `--pids-limit`: Tune container pids limit
 - :nerd_face: `--cgroup-conf`: Configure cgroup v2 (key=value)
 - :whale: `blkio-weight`: Block IO (relative weight), between 10 and 1000, or 0 to disable (default 0)

cmd/nerdctl/run.go

@@ -145,6 +145,7 @@ func setCreateFlags(cmd *cobra.Command) {
 	// #region cgroups, namespaces, and ulimits flags
 	cmd.Flags().Float64("cpus", 0.0, "Number of CPUs")
 	cmd.Flags().StringP("memory", "m", "", "Memory limit")
+	cmd.Flags().Bool("oom-kill-disable", false, "Disable OOM Killer")
 	cmd.Flags().String("pid", "", "PID namespace to use")
 	cmd.RegisterFlagCompletionFunc("pid", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"host"}, cobra.ShellCompDirectiveNoFileComp

cmd/nerdctl/run_cgroup_linux.go

@@ -49,6 +49,15 @@ func generateCgroupOpts(cmd *cobra.Command, id string) ([]oci.SpecOpts, error) {
 	if err != nil {
 		return nil, err
 	}
+
+	okd, err := cmd.Flags().GetBool("oom-kill-disable")
+	if err != nil {
+		return nil, err
+	}
+	if memStr == "" && okd {
+		logrus.Warn("Disabling the OOM killer on containers without setting a '-m/--memory' limit may be dangerous.")
+	}
+
 	pidsLimit, err := cmd.Flags().GetInt64("pids-limit")
 	if err != nil {
 		return nil, err
@@ -130,6 +139,10 @@ func generateCgroupOpts(cmd *cobra.Command, id string) ([]oci.SpecOpts, error) {
 		opts = append(opts, oci.WithMemoryLimit(uint64(mem64)))
 	}
 
+	if okd {
+		opts = append(opts, withDisableOOMKiller(okd))
+	}
+
 	if pidsLimit > 0 {
 		opts = append(opts, oci.WithPidsLimit(int64(pidsLimit)))
 	}
@@ -274,3 +287,18 @@ func withBlkioWeight(blkioWeight uint16) oci.SpecOpts {
 		return nil
 	}
 }
+
+func withDisableOOMKiller(disableOOMKiller bool) oci.SpecOpts {
+	return func(_ context.Context, _ oci.Client, _ *containers.Container, s *oci.Spec) error {
+		if s.Linux != nil {
+			if s.Linux.Resources == nil {
+				s.Linux.Resources = &specs.LinuxResources{}
+			}
+			if s.Linux.Resources.Memory == nil {
+				s.Linux.Resources.Memory = &specs.LinuxMemory{}
+			}
+			s.Linux.Resources.Memory.DisableOOMKiller = &disableOOMKiller
+		}
+		return nil
+	}
+}