Understanding memory limits in a systemd service: Are they per-process or combined?

Question

I have a systemd service named vcoagent.service running on my Linux system, and I'm trying to understand how memory limits specified for the service (Memory: 300.3M (limit: 500.0M)) apply to the processes it manages.

Here is the relevant output from systemctl status vcoagent.service:

● vcoagent.service - Observability Agent
     Loaded: loaded (/etc/systemd/system/vcoagent.service; enabled; vendor preset: enabled)
     Active: active (running) since Wed 2024-04-10 11:05:17 +07; 3h 38min ago
   Main PID: 134018 (vcoagent)
      Tasks: 59 (limit: 18691)
     Memory: 300.3M (limit: 500.0M)
     CGroup: /system.slice/vcoagent.service
             ├─134018 /root/vcoagent --opampServer=false --nodeExporter=true
             ├─134031 /root/vcoagent --opampServer=false --nodeExporter=true
             ├─134038 /proc/134031/fd/3
             └─134050 /proc/134031/fd/8 --config /tmp/otelcol/otelcol-config.yaml

My question is: Does the memory limit (500.0M) apply individually to each process (134018, 134031, etc.) managed by the service, or is it a combined limit for all processes together?

For instance, if one process exceeds its individual memory limit but the total memory usage across all processes remains below 500.0M, will the service be considered within its memory limits?

I would appreciate any clarification on how systemd memory limits are enforced within a service context. Thank you!

Answer 1

Linux supports limits using two mechanisms

• ulimit which is (mostly) per process
• cgroups which limits totals for the group of processes added to the cgroup

Most of the limits systemd sets, including this one, are based on cgroups. When systemd creates a service, it puts all the processes in the service in a cgroup, and applies the limits to the cgroup. So the numbers are the totals for the whole cgroup.

Much of this is described in the man page for systemd.resource-control