diff --git a/.build_id b/.build_id
index 50a688c4a..cb7698385 100644
--- a/.build_id
+++ b/.build_id
@@ -1 +1 @@
-18.09.0.build20181115124313
+18.09.0.build20181116172621
diff --git a/os/packages/osctl/Gemfile b/os/packages/osctl/Gemfile
index a65cc77c5..5d3a1022b 100644
--- a/os/packages/osctl/Gemfile
+++ b/os/packages/osctl/Gemfile
@@ -1,2 +1,2 @@
 source 'https://rubygems.vpsfree.cz'
-gem 'osctl', '18.09.0.build20181115124313'
+gem 'osctl', '18.09.0.build20181116172621'
diff --git a/os/packages/osctl/Gemfile.lock b/os/packages/osctl/Gemfile.lock
index ab30538c7..198b6639a 100644
--- a/os/packages/osctl/Gemfile.lock
+++ b/os/packages/osctl/Gemfile.lock
@@ -6,15 +6,15 @@ GEM
     highline (1.7.10)
     ipaddress (0.8.3)
     json (2.1.0)
-    libosctl (18.09.0.build20181115124313)
+    libosctl (18.09.0.build20181116172621)
       require_all (~> 2.0.0)
-    osctl (18.09.0.build20181115124313)
+    osctl (18.09.0.build20181116172621)
       curses
       gli (~> 2.17.1)
       highline (~> 1.7.10)
       ipaddress (~> 0.8.3)
       json
-      libosctl (= 18.09.0.build20181115124313)
+      libosctl (= 18.09.0.build20181116172621)
       rainbow (~> 3.0.0)
       require_all (~> 2.0.0)
       ruby-progressbar (~> 1.9.0)
@@ -26,7 +26,7 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
-  osctl (= 18.09.0.build20181115124313)
+  osctl (= 18.09.0.build20181116172621)
 
 BUNDLED WITH
    1.16.3
diff --git a/os/packages/osctl/gemset.nix b/os/packages/osctl/gemset.nix
index e882adc0c..be07e5ed8 100644
--- a/os/packages/osctl/gemset.nix
+++ b/os/packages/osctl/gemset.nix
@@ -43,19 +43,19 @@
     dependencies = ["require_all"];
     source = {
       remotes = ["https://rubygems.vpsfree.cz"];
-      sha256 = "0ibqm6hs74gh2dn23ir0aqs3l25rssh5wjqbvbjvsnvcbki2lnkj";
+      sha256 = "0kk7v1zafjrji9dj6frvph9qgdrqly8y8yw70xkhamdh0dcjv152";
       type = "gem";
     };
-    version = "18.09.0.build20181115124313";
+    version = "18.09.0.build20181116172621";
   };
   osctl = {
     dependencies = ["curses" "gli" "highline" "ipaddress" "json" "libosctl" "rainbow" "require_all" "ruby-progressbar"];
     source = {
       remotes = ["https://rubygems.vpsfree.cz"];
-      sha256 = "1wb7c70bcqvrvr8x85x6iyx7lkl716sbh0k1b72iy3icyzinzil3";
+      sha256 = "0384n277r380bkpvvgbkzk6dzg9fvp8syzb5v7fqhlpb8y6cyqdi";
       type = "gem";
     };
-    version = "18.09.0.build20181115124313";
+    version = "18.09.0.build20181116172621";
   };
   rainbow = {
     source = {
diff --git a/os/packages/osctld/Gemfile b/os/packages/osctld/Gemfile
index 7317177dd..709e41219 100644
--- a/os/packages/osctld/Gemfile
+++ b/os/packages/osctld/Gemfile
@@ -1,2 +1,2 @@
 source 'https://rubygems.vpsfree.cz'
-gem 'osctld', '18.09.0.build20181115124313'
+gem 'osctld', '18.09.0.build20181116172621'
diff --git a/os/packages/osctld/Gemfile.lock b/os/packages/osctld/Gemfile.lock
index fb767d80a..5ff1cfd65 100644
--- a/os/packages/osctld/Gemfile.lock
+++ b/os/packages/osctld/Gemfile.lock
@@ -6,29 +6,29 @@ GEM
     gli (2.17.2)
     ipaddress (0.8.3)
     json (2.1.0)
-    libosctl (18.09.0.build20181115124313)
+    libosctl (18.09.0.build20181116172621)
       require_all (~> 2.0.0)
     netlinkrb (0.18.vpsadminos.0)
-    osctl-repo (18.09.0.build20181115124313)
+    osctl-repo (18.09.0.build20181116172621)
       filelock
       gli (~> 2.17.1)
       json
-      libosctl (= 18.09.0.build20181115124313)
+      libosctl (= 18.09.0.build20181116172621)
       require_all (~> 2.0.0)
-    osctld (18.09.0.build20181115124313)
+    osctld (18.09.0.build20181116172621)
       concurrent-ruby (~> 1.0.5)
       ipaddress (~> 0.8.3)
       json
-      libosctl (= 18.09.0.build20181115124313)
+      libosctl (= 18.09.0.build20181116172621)
       netlinkrb (= 0.18.vpsadminos.0)
-      osctl-repo (= 18.09.0.build20181115124313)
-      osup (= 18.09.0.build20181115124313)
+      osctl-repo (= 18.09.0.build20181116172621)
+      osup (= 18.09.0.build20181116172621)
       require_all (~> 2.0.0)
       ruby-lxc (= 1.2.3)
-    osup (18.09.0.build20181115124313)
+    osup (18.09.0.build20181116172621)
       gli (~> 2.17.1)
       json
-      libosctl (= 18.09.0.build20181115124313)
+      libosctl (= 18.09.0.build20181116172621)
       require_all (~> 2.0.0)
     require_all (2.0.0)
     ruby-lxc (1.2.3)
@@ -37,7 +37,7 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
-  osctld (= 18.09.0.build20181115124313)
+  osctld (= 18.09.0.build20181116172621)
 
 BUNDLED WITH
    1.16.3
diff --git a/os/packages/osctld/gemset.nix b/os/packages/osctld/gemset.nix
index 32ed46c6c..263f8b2e1 100644
--- a/os/packages/osctld/gemset.nix
+++ b/os/packages/osctld/gemset.nix
@@ -43,10 +43,10 @@
     dependencies = ["require_all"];
     source = {
       remotes = ["https://rubygems.vpsfree.cz"];
-      sha256 = "0ibqm6hs74gh2dn23ir0aqs3l25rssh5wjqbvbjvsnvcbki2lnkj";
+      sha256 = "0kk7v1zafjrji9dj6frvph9qgdrqly8y8yw70xkhamdh0dcjv152";
       type = "gem";
     };
-    version = "18.09.0.build20181115124313";
+    version = "18.09.0.build20181116172621";
   };
   netlinkrb = {
     source = {
@@ -60,28 +60,28 @@
     dependencies = ["filelock" "gli" "json" "libosctl" "require_all"];
     source = {
       remotes = ["https://rubygems.vpsfree.cz"];
-      sha256 = "1j0dz5q7hl1di2rzppfsa0fgin63l4nm3gyib4v726c5403l9dnk";
+      sha256 = "0mghxd0j6iy5b777hmbq3h0g26j10yvvg2whw3b2hn322bh6l6j1";
       type = "gem";
     };
-    version = "18.09.0.build20181115124313";
+    version = "18.09.0.build20181116172621";
   };
   osctld = {
     dependencies = ["concurrent-ruby" "ipaddress" "json" "libosctl" "netlinkrb" "osctl-repo" "osup" "require_all" "ruby-lxc"];
     source = {
       remotes = ["https://rubygems.vpsfree.cz"];
-      sha256 = "00w6b0a01ckz7vr2d704j1isx6lnpcrkgn72ddasw392pqli83bi";
+      sha256 = "02yb1837v7kbxinl51jlxsrjgb5q8lhjig94fpmcwscsdh3rd02b";
       type = "gem";
     };
-    version = "18.09.0.build20181115124313";
+    version = "18.09.0.build20181116172621";
   };
   osup = {
     dependencies = ["gli" "json" "libosctl" "require_all"];
     source = {
       remotes = ["https://rubygems.vpsfree.cz"];
-      sha256 = "0piqri8m1drpgcp7bqpgk1kh9kbzssfybbkzvp2whfdpmnkndvm5";
+      sha256 = "0vj90ig2rvrwqhmrc8bkzz7nac429zqnp2fj70dq9s2h6j6mjdyv";
       type = "gem";
     };
-    version = "18.09.0.build20181115124313";
+    version = "18.09.0.build20181116172621";
   };
   require_all = {
     source = {
diff --git a/os/packages/osup/Gemfile b/os/packages/osup/Gemfile
index 30a6bc15f..2f3cc114e 100644
--- a/os/packages/osup/Gemfile
+++ b/os/packages/osup/Gemfile
@@ -1,2 +1,2 @@
 source 'https://rubygems.vpsfree.cz'
-gem 'osup', '18.09.0.build20181115124313'
+gem 'osup', '18.09.0.build20181116172621'
diff --git a/os/packages/osup/Gemfile.lock b/os/packages/osup/Gemfile.lock
index 8b4406f9f..b4f87d0a5 100644
--- a/os/packages/osup/Gemfile.lock
+++ b/os/packages/osup/Gemfile.lock
@@ -3,12 +3,12 @@ GEM
   specs:
     gli (2.17.2)
     json (2.1.0)
-    libosctl (18.09.0.build20181115124313)
+    libosctl (18.09.0.build20181116172621)
       require_all (~> 2.0.0)
-    osup (18.09.0.build20181115124313)
+    osup (18.09.0.build20181116172621)
       gli (~> 2.17.1)
       json
-      libosctl (= 18.09.0.build20181115124313)
+      libosctl (= 18.09.0.build20181116172621)
       require_all (~> 2.0.0)
     require_all (2.0.0)
 
@@ -16,7 +16,7 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
-  osup (= 18.09.0.build20181115124313)
+  osup (= 18.09.0.build20181116172621)
 
 BUNDLED WITH
    1.16.3
diff --git a/os/packages/osup/gemset.nix b/os/packages/osup/gemset.nix
index a1ac34812..d765643b0 100644
--- a/os/packages/osup/gemset.nix
+++ b/os/packages/osup/gemset.nix
@@ -19,19 +19,19 @@
     dependencies = ["require_all"];
     source = {
       remotes = ["https://rubygems.vpsfree.cz"];
-      sha256 = "0ibqm6hs74gh2dn23ir0aqs3l25rssh5wjqbvbjvsnvcbki2lnkj";
+      sha256 = "0kk7v1zafjrji9dj6frvph9qgdrqly8y8yw70xkhamdh0dcjv152";
       type = "gem";
     };
-    version = "18.09.0.build20181115124313";
+    version = "18.09.0.build20181116172621";
   };
   osup = {
     dependencies = ["gli" "json" "libosctl" "require_all"];
     source = {
       remotes = ["https://rubygems.vpsfree.cz"];
-      sha256 = "0piqri8m1drpgcp7bqpgk1kh9kbzssfybbkzvp2whfdpmnkndvm5";
+      sha256 = "0vj90ig2rvrwqhmrc8bkzz7nac429zqnp2fj70dq9s2h6j6mjdyv";
       type = "gem";
     };
-    version = "18.09.0.build20181115124313";
+    version = "18.09.0.build20181116172621";
   };
   require_all = {
     source = {
diff --git a/os/packages/svctl/Gemfile b/os/packages/svctl/Gemfile
index 17a00d5d2..1f0893c56 100644
--- a/os/packages/svctl/Gemfile
+++ b/os/packages/svctl/Gemfile
@@ -1,2 +1,2 @@
 source 'https://rubygems.vpsfree.cz'
-gem 'svctl', '18.09.0.build20181115124313'
+gem 'svctl', '18.09.0.build20181116172621'
diff --git a/os/packages/svctl/Gemfile.lock b/os/packages/svctl/Gemfile.lock
index d1c0bb6f6..7cc6505e2 100644
--- a/os/packages/svctl/Gemfile.lock
+++ b/os/packages/svctl/Gemfile.lock
@@ -2,18 +2,18 @@ GEM
   remote: https://rubygems.vpsfree.cz/
   specs:
     gli (2.17.2)
-    libosctl (18.09.0.build20181115124313)
+    libosctl (18.09.0.build20181116172621)
       require_all (~> 2.0.0)
     require_all (2.0.0)
-    svctl (18.09.0.build20181115124313)
+    svctl (18.09.0.build20181116172621)
       gli (~> 2.17.1)
-      libosctl (= 18.09.0.build20181115124313)
+      libosctl (= 18.09.0.build20181116172621)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  svctl (= 18.09.0.build20181115124313)
+  svctl (= 18.09.0.build20181116172621)
 
 BUNDLED WITH
    1.16.3
diff --git a/os/packages/svctl/gemset.nix b/os/packages/svctl/gemset.nix
index 06559727f..dda809c50 100644
--- a/os/packages/svctl/gemset.nix
+++ b/os/packages/svctl/gemset.nix
@@ -11,10 +11,10 @@
     dependencies = ["require_all"];
     source = {
       remotes = ["https://rubygems.vpsfree.cz"];
-      sha256 = "0ibqm6hs74gh2dn23ir0aqs3l25rssh5wjqbvbjvsnvcbki2lnkj";
+      sha256 = "0kk7v1zafjrji9dj6frvph9qgdrqly8y8yw70xkhamdh0dcjv152";
       type = "gem";
     };
-    version = "18.09.0.build20181115124313";
+    version = "18.09.0.build20181116172621";
   };
   require_all = {
     source = {
@@ -28,9 +28,9 @@
     dependencies = ["gli" "libosctl"];
     source = {
       remotes = ["https://rubygems.vpsfree.cz"];
-      sha256 = "1wwsf4z78wl2p9bf297rakyw0539007ky3ipjbvay6d62hdi5k7w";
+      sha256 = "1kmha18nciayy0gn1j4g884rxypws7kz62fbc06ynclx61v987md";
       type = "gem";
     };
-    version = "18.09.0.build20181115124313";
+    version = "18.09.0.build20181116172621";
   };
 }
\ No newline at end of file
diff --git a/osctl/lib/osctl/cli/container.rb b/osctl/lib/osctl/cli/container.rb
index a3c16780e..1f2efa152 100644
--- a/osctl/lib/osctl/cli/container.rb
+++ b/osctl/lib/osctl/cli/container.rb
@@ -925,7 +925,8 @@ def prlimit_list
         cols = PRLIMIT_FIELDS
       end
 
-      osctld_fmt(:ct_prlimit_list, cmd_opts, cols, fmt_opts)
+      data = osctld_call(:ct_prlimit_list, cmd_opts)
+      format_output(data.map { |k, v| v.merge(name: k)}, cols, fmt_opts)
     end
 
     def prlimit_set
diff --git a/osctld/lib/osctld.rb b/osctld/lib/osctld.rb
index e4096ce15..e245ecc5f 100644
--- a/osctld/lib/osctld.rb
+++ b/osctld/lib/osctld.rb
@@ -19,6 +19,7 @@ module DB ; end
   module Devices ; end
   module Generic ; end
   module Mount ; end
+  module PrLimits ; end
   module Routing ; end
   module Utils ; end
   module UserControl
@@ -64,6 +65,7 @@ def self.tpl(name)
 require_rel 'osctld/monitor'
 require_rel 'osctld/mount'
 require_rel 'osctld/net_interface'
+require_rel 'osctld/prlimits'
 require_rel 'osctld/repository'
 require_rel 'osctld/routing'
 require_rel 'osctld/switch_user'
diff --git a/osctld/lib/osctld/commands/container/prlimit_list.rb b/osctld/lib/osctld/commands/container/prlimit_list.rb
index 0c4794b88..b39b3eac6 100644
--- a/osctld/lib/osctld/commands/container/prlimit_list.rb
+++ b/osctld/lib/osctld/commands/container/prlimit_list.rb
@@ -8,14 +8,15 @@ def execute
       ct = DB::Containers.find(opts[:id], opts[:pool])
       return error('container not found') unless ct
 
-      ct.inclusively do
-        ret = ct.prlimits.select do |limit|
-          next(false) if opts[:limits] && !opts[:limits].include?(limit.name)
-          true
-        end.map(&:export)
+      ret = {}
 
-        ok(ret)
+      ct.prlimits.each do |name, limit|
+        next if opts[:limits] && !opts[:limits].include?(name)
+
+        ret[name] = limit.export
       end
+
+      ok(ret)
     end
   end
 end
diff --git a/osctld/lib/osctld/commands/container/prlimit_set.rb b/osctld/lib/osctld/commands/container/prlimit_set.rb
index e41921f75..7b5b579cb 100644
--- a/osctld/lib/osctld/commands/container/prlimit_set.rb
+++ b/osctld/lib/osctld/commands/container/prlimit_set.rb
@@ -32,11 +32,8 @@ def execute(ct)
       hard = parse(opts[:hard])
 
       validate(opts[:name], soft, hard)
-
-      ct.exclusively do
-        ct.prlimit_set(opts[:name], soft, hard)
-        ok
-      end
+      ct.prlimits.set(opts[:name], soft, hard)
+      ok
     end
 
     protected
diff --git a/osctld/lib/osctld/commands/container/prlimit_unset.rb b/osctld/lib/osctld/commands/container/prlimit_unset.rb
index d025b10a9..bcd0e7455 100644
--- a/osctld/lib/osctld/commands/container/prlimit_unset.rb
+++ b/osctld/lib/osctld/commands/container/prlimit_unset.rb
@@ -10,10 +10,8 @@ def find
     end
 
     def execute(ct)
-      ct.exclusively do
-        ct.prlimit_unset(opts[:name])
-        ok
-      end
+      ct.prlimit_unset(opts[:name])
+      ok
     end
   end
 end
diff --git a/osctld/lib/osctld/container.rb b/osctld/lib/osctld/container.rb
index f0461b640..79bcde094 100644
--- a/osctld/lib/osctld/container.rb
+++ b/osctld/lib/osctld/container.rb
@@ -49,7 +49,7 @@ def initialize(pool, id, user = nil, group = nil, dataset = nil, opts = {})
       @netifs = NetInterface::Manager.new(self)
       @cgparams = nil
       @devices = nil
-      @prlimits = []
+      @prlimits = nil
       @mounts = nil
       @hostname = nil
       @dns_resolvers = nil
@@ -79,6 +79,7 @@ def configure(distribution, version, arch)
         @seccomp_profile = default_seccomp_profile
         @cgparams = CGroup::ContainerParams.new(self)
         @devices = Devices::ContainerManager.new(self)
+        @prlimits = PrLimits::Manager.new(self)
         @mounts = Mount::Manager.new(self)
         devices.init
         save_config
@@ -579,7 +580,7 @@ def load_config(config = nil, init_devices = true)
         @seccomp_profile = cfg['seccomp_profile'] || default_seccomp_profile
         @migration_log = Migration::Log.load(cfg['migration_log']) if cfg['migration_log']
         @cgparams = CGroup::ContainerParams.load(self, cfg['cgparams'])
-        @prlimits = (cfg['prlimits'] || []).map { |v| PrLimit.load(v) }
+        @prlimits = PrLimits::Manager.load(self, cfg['prlimits'] || {})
         @attrs = Attributes.load(cfg['attrs'] || {})
 
         # It's necessary to load devices _before_ netifs. The device manager needs
@@ -608,7 +609,7 @@ def dump
           'net_interfaces' => netifs.dump,
           'cgparams' => cgparams.dump,
           'devices' => devices.dump,
-          'prlimits' => prlimits.map(&:dump),
+          'prlimits' => prlimits.dump,
           'mounts' => mounts.dump,
           'autostart' => autostart && autostart.dump,
           'hostname' => hostname && hostname.to_s,
@@ -658,6 +659,7 @@ def clone_from(ct, id, opts = {})
       @apparmor = @apparmor.dup(self)
       @autostart = @autostart && @autostart.dup(self)
       @cgparams = cgparams.dup(self)
+      @prlimits = prlimits.dup(self)
       @mounts = mounts.dup(self)
       @lxc_config = lxc_config.dup(self)
       @attrs = attrs.dup
diff --git a/osctld/lib/osctld/prlimits/manager.rb b/osctld/lib/osctld/prlimits/manager.rb
new file mode 100644
index 000000000..91a4a3cf0
--- /dev/null
+++ b/osctld/lib/osctld/prlimits/manager.rb
@@ -0,0 +1,79 @@
+require 'osctld/lockable'
+
+module OsCtld
+  class PrLimits::Manager
+    include Lockable
+
+    # Load prlimits from config
+    # @param ct [Container]
+    # @param cfg [Array]
+    def self.load(ct, cfg)
+      if cfg.is_a?(Array)
+        entries = cfg.map do |v|
+          [v['name'], PrLimits::PrLimit.load(v['name'], v)]
+        end
+      else
+        entries = cfg.map { |k, v| [k, PrLimits::PrLimit.load(k, v)] }
+      end
+
+      new(ct, entries: Hash[entries])
+    end
+
+    # @param ct [Container]
+    def initialize(ct, entries: {})
+      init_lock
+
+      @ct = ct
+      @prlimits = entries
+    end
+
+    # @param name [String]
+    # @param soft [Integer]
+    # @param hard [Integer]
+    def set(name, soft, hard)
+      exclusively do
+        if prlimits.has_key?(name)
+          prlimits[name].set(soft, hard)
+        else
+          prlimits[name] = PrLimits::PrLimit.new(name, soft, hard)
+        end
+      end
+
+      ct.save_config
+      ct.lxc_config.configure_prlimits
+    end
+
+    # @param name [String]
+    def unset(name)
+      exclusively { prlimits.delete(name) }
+      ct.save_config
+    end
+
+    # @param name [String]
+    # @return [PrLimits::PrLimit, nil]
+    def [](name)
+      inclusively { prlimits[name] }
+    end
+
+    # @yieldparam name [String]
+    # @yieldparam prlimit [PrLimits::PrLimit]
+    def each(&block)
+      inclusively { prlimits.each(&block) }
+    end
+
+    # Dump to config
+    def dump
+      inclusively { Hash[prlimits.map { |k, v| [k, v.dump] }] }
+    end
+
+    def dup(new_ct)
+      ret = super()
+      ret.instance_variable_set('@ct', new_ct)
+      ret.instance_variable_set('@prlimits', prlimits.map { |v| v.clone })
+      ret
+    end
+
+    protected
+    attr_reader :ct, :prlimits
+  end
+end
diff --git a/osctld/lib/osctld/prlimit.rb b/osctld/lib/osctld/prlimits/prlimit.rb
similarity index 58%
rename from osctld/lib/osctld/prlimit.rb
rename to osctld/lib/osctld/prlimits/prlimit.rb
index 58e5ad8d0..f41976ae3 100644
--- a/osctld/lib/osctld/prlimit.rb
+++ b/osctld/lib/osctld/prlimits/prlimit.rb
@@ -1,11 +1,10 @@
 module OsCtld
-  class PrLimit
-    PARAMS = %i(name soft hard)
+  class PrLimits::PrLimit
     attr_reader :name, :soft, :hard
 
     # Load from config
-    def self.load(cfg)
-      new(* PARAMS.map { |v| cfg[v.to_s] })
+    def self.load(name, cfg)
+      new(name, cfg['soft'], cfg['hard'])
     end
 
     def initialize(name, soft, hard)
@@ -21,12 +20,12 @@ def set(soft, hard)
 
     # Export to client
     def export
-      Hash[PARAMS.map { |v| [v, instance_variable_get(:"@#{v}")] }]
+      {soft: soft, hard: hard}
     end
 
     # Dump to config
     def dump
-      Hash[PARAMS.map { |v| [v.to_s, instance_variable_get(:"@#{v}")] }]
+      {'soft' => soft, 'hard' => hard}
     end
   end
 end
diff --git a/osctld/templates/ct/prlimits.erb b/osctld/templates/ct/prlimits.erb
index 01379dc23..65416b203 100644
--- a/osctld/templates/ct/prlimits.erb
+++ b/osctld/templates/ct/prlimits.erb
@@ -1,3 +1,3 @@
-<% prlimits.each do |limit| -%>
-lxc.prlimit.<%= limit.name %> = <%= limit.soft %>:<%= limit.hard %>
+<% prlimits.each do |name, limit| -%>
+lxc.prlimit.<%= name %> = <%= limit.soft %>:<%= limit.hard %>
 <% end -%>