man/systemd.resource-control.xml

   1 <?xml version='1.0'?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   This file is part of systemd.
   7
   8   Copyright 2013 Zbigniew Jędrzejewski-Szmek
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published by
  12   the Free Software Foundation; either version 2.1 of the License, or
  13   (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 -->
  23
  24 <refentry id="systemd.resource-control">
  25   <refentryinfo>
  26     <title>systemd.resource-control</title>
  27     <productname>systemd</productname>
  28
  29     <authorgroup>
  30       <author>
  31         <contrib>Developer</contrib>
  32         <firstname>Lennart</firstname>
  33         <surname>Poettering</surname>
  34         <email>lennart@poettering.net</email>
  35       </author>
  36     </authorgroup>
  37   </refentryinfo>
  38
  39   <refmeta>
  40     <refentrytitle>systemd.resource-control</refentrytitle>
  41     <manvolnum>5</manvolnum>
  42   </refmeta>
  43
  44   <refnamediv>
  45     <refname>systemd.resource-control</refname>
  46     <refpurpose>Resource control unit settings</refpurpose>
  47   </refnamediv>
  48
  49   <refsynopsisdiv>
  50     <para>
  51       <filename><replaceable>slice</replaceable>.slice</filename>,
  52       <filename><replaceable>scope</replaceable>.scope</filename>,
  53       <filename><replaceable>service</replaceable>.service</filename>,
  54       <filename><replaceable>socket</replaceable>.socket</filename>,
  55       <filename><replaceable>mount</replaceable>.mount</filename>,
  56       <filename><replaceable>swap</replaceable>.swap</filename>
  57     </para>
  58   </refsynopsisdiv>
  59
  60   <refsect1>
  61     <title>Description</title>
  62
  63     <para>Unit configuration files for services, slices, scopes, sockets, mount points, and swap devices share a subset
  64     of configuration options for resource control of spawned processes. Internally, this relies on the Linux Control
  65     Groups (cgroups) kernel concept for organizing processes in a hierarchical tree of named groups for the purpose of
  66     resource management.</para>
  67
  68     <para>This man page lists the configuration options shared by
  69     those six unit types. See
  70     <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
  71     for the common options of all unit configuration files, and
  72     <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  73     <citerefentry><refentrytitle>systemd.scope</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  74     <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  75     <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  76     <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  77     and
  78     <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>
  79     for more information on the specific unit configuration files. The
  80     resource control configuration options are configured in the
  81     [Slice], [Scope], [Service], [Socket], [Mount], or [Swap]
  82     sections, depending on the unit type.</para>
  83
  84     <para>In addition, options which control resources available to programs
  85     <emphasis>executed</emphasis> by systemd are listed in
  86     <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
  87     Those options complement options listed here.</para>
  88
  89     <para>See the <ulink
  90     url="https://www.freedesktop.org/wiki/Software/systemd/ControlGroupInterface/">New
  91     Control Group Interfaces</ulink> for an introduction on how to make
  92     use of resource control APIs from programs.</para>
  93   </refsect1>
  94
  95   <refsect1>
  96     <title>Automatic Dependencies</title>
  97
  98     <para>Units with the <varname>Slice=</varname> setting set automatically acquire <varname>Requires=</varname> and
  99     <varname>After=</varname> dependencies on the specified slice unit.</para>
 100   </refsect1>
 101
 102   <refsect1>
 103     <title>Unified and Legacy Control Group Hierarchies</title>
 104
 105     <para>The unified control group hierarchy is the new version of kernel control group interface, see <ulink
 106     url="https://www.kernel.org/doc/Documentation/cgroup-v2.txt">cgroup-v2.txt</ulink>. Depending on the resource type,
 107     there are differences in resource control capabilities.  Also, because of interface changes, some resource types
 108     have separate set of options on the unified hierarchy.</para>
 109
 110     <para>
 111       <variablelist>
 112
 113         <varlistentry>
 114           <term><option>CPU</option></term>
 115           <listitem>
 116             <para>Due to the lack of consensus in the kernel community, the CPU controller support on the unified
 117             control group hierarchy requires out-of-tree kernel patches. See <ulink
 118             url="https://git.kernel.org/cgit/linux/kernel/git/tj/cgroup.git/tree/Documentation/cgroup-v2-cpu.txt?h=cgroup-v2-cpu">cgroup-v2-cpu.txt</ulink>.</para>
 119
 120             <para><varname>CPUWeight=</varname> and <varname>StartupCPUWeight=</varname> replace
 121             <varname>CPUShares=</varname> and <varname>StartupCPUShares=</varname>, respectively.</para>
 122
 123             <para>The <literal>cpuacct</literal> controller does not exist separately on the unified hierarchy.</para>
 124           </listitem>
 125         </varlistentry>
 126
 127         <varlistentry>
 128           <term><option>Memory</option></term>
 129           <listitem>
 130             <para><varname>MemoryMax=</varname> replaces <varname>MemoryLimit=</varname>. <varname>MemoryLow=</varname>
 131             and <varname>MemoryHigh=</varname> are effective only on unified hierarchy.</para>
 132           </listitem>
 133         </varlistentry>
 134
 135         <varlistentry>
 136           <term><option>IO</option></term>
 137           <listitem>
 138             <para><varname>IO</varname> prefixed settings are superset of and replace <varname>BlockIO</varname>
 139             prefixed ones. On unified hierarchy, IO resource control also applies to buffered writes.</para>
 140           </listitem>
 141         </varlistentry>
 142
 143       </variablelist>
 144     </para>
 145
 146     <para>To ease the transition, there is best-effort translation between the two versions of settings. For each
 147     controller, if any of the settings for the unified hierarchy are present, all settings for the legacy hierarchy are
 148     ignored. If the resulting settings are for the other type of hierarchy, the configurations are translated before
 149     application.</para>
 150
 151     <para>Legacy control group hierarchy (see <ulink
 152     url="https://www.kernel.org/doc/Documentation/cgroup-v1/cgroups.txt">cgroups.txt</ulink>), also called cgroup-v1,
 153     doesn't allow safe delegation of controllers to unprivileged processes. If the system uses the legacy control group
 154     hierarchy, resource control is disabled for systemd user instance, see
 155     <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
 156     </para>
 157   </refsect1>
 158
 159   <refsect1>
 160     <title>Options</title>
 161
 162     <para>Units of the types listed above can have settings
 163     for resource control configuration:</para>
 164
 165     <variablelist class='unit-directives'>
 166
 167       <varlistentry>
 168         <term><varname>CPUAccounting=</varname></term>
 169
 170         <listitem>
 171           <para>Turn on CPU usage accounting for this unit. Takes a
 172           boolean argument. Note that turning on CPU accounting for
 173           one unit will also implicitly turn it on for all units
 174           contained in the same slice and for all its parent slices
 175           and the units contained therein. The system default for this
 176           setting may be controlled with
 177           <varname>DefaultCPUAccounting=</varname> in
 178           <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
 179         </listitem>
 180       </varlistentry>
 181
 182       <varlistentry>
 183         <term><varname>CPUWeight=<replaceable>weight</replaceable></varname></term>
 184         <term><varname>StartupCPUWeight=<replaceable>weight</replaceable></varname></term>
 185
 186         <listitem>
 187           <para>Assign the specified CPU time weight to the processes executed, if the unified control group hierarchy
 188           is used on the system. These options take an integer value and control the <literal>cpu.weight</literal>
 189           control group attribute. The allowed range is 1 to 10000. Defaults to 100. For details about this control
 190           group attribute, see <ulink
 191           url="https://www.kernel.org/doc/Documentation/cgroup-v2.txt">cgroup-v2.txt</ulink> and <ulink
 192           url="https://www.kernel.org/doc/Documentation/scheduler/sched-design-CFS.txt">sched-design-CFS.txt</ulink>.
 193           The available CPU time is split up among all units within one slice relative to their CPU time weight.</para>
 194
 195           <para>While <varname>StartupCPUWeight=</varname> only applies to the startup phase of the system,
 196           <varname>CPUWeight=</varname> applies to normal runtime of the system, and if the former is not set also to
 197           the startup phase. Using <varname>StartupCPUWeight=</varname> allows prioritizing specific services at
 198           boot-up differently than during normal runtime.</para>
 199
 200           <para>Implies <literal>CPUAccounting=true</literal>.</para>
 201
 202           <para>These settings replace <varname>CPUShares=</varname> and <varname>StartupCPUShares=</varname>.</para>
 203         </listitem>
 204       </varlistentry>
 205
 206       <varlistentry>
 207         <term><varname>CPUQuota=</varname></term>
 208
 209         <listitem>
 210           <para>Assign the specified CPU time quota to the processes executed. Takes a percentage value, suffixed with
 211           "%". The percentage specifies how much CPU time the unit shall get at maximum, relative to the total CPU time
 212           available on one CPU. Use values &gt; 100% for allotting CPU time on more than one CPU. This controls the
 213           <literal>cpu.max</literal> attribute on the unified control group hierarchy and
 214           <literal>cpu.cfs_quota_us</literal> on legacy. For details about these control group attributes, see <ulink
 215           url="https://www.kernel.org/doc/Documentation/cgroup-v2.txt">cgroup-v2.txt</ulink> and <ulink
 216           url="https://www.kernel.org/doc/Documentation/scheduler/sched-design-CFS.txt">sched-design-CFS.txt</ulink>.</para>
 217
 218           <para>Example: <varname>CPUQuota=20%</varname> ensures that the executed processes will never get more than
 219           20% CPU time on one CPU.</para>
 220
 221           <para>Implies <literal>CPUAccounting=true</literal>.</para>
 222         </listitem>
 223       </varlistentry>
 224
 225       <varlistentry>
 226         <term><varname>MemoryAccounting=</varname></term>
 227
 228         <listitem>
 229           <para>Turn on process and kernel memory accounting for this
 230           unit. Takes a boolean argument. Note that turning on memory
 231           accounting for one unit will also implicitly turn it on for
 232           all units contained in the same slice and for all its parent
 233           slices and the units contained therein. The system default
 234           for this setting may be controlled with
 235           <varname>DefaultMemoryAccounting=</varname> in
 236           <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
 237         </listitem>
 238       </varlistentry>
 239
 240       <varlistentry>
 241         <term><varname>MemoryLow=<replaceable>bytes</replaceable></varname></term>
 242
 243         <listitem>
 244           <para>Specify the best-effort memory usage protection of the executed processes in this unit. If the memory
 245           usages of this unit and all its ancestors are below their low boundaries, this unit's memory won't be
 246           reclaimed as long as memory can be reclaimed from unprotected units.</para>
 247
 248           <para>Takes a memory size in bytes. If the value is suffixed with K, M, G or T, the specified memory size is
 249           parsed as Kilobytes, Megabytes, Gigabytes, or Terabytes (with the base 1024), respectively. Alternatively, a
 250           percentage value may be specified, which is taken relative to the installed physical memory on the
 251           system. This controls the <literal>memory.low</literal> control group attribute. For details about this
 252           control group attribute, see <ulink
 253           url="https://www.kernel.org/doc/Documentation/cgroup-v2.txt">cgroup-v2.txt</ulink>.</para>
 254
 255           <para>Implies <literal>MemoryAccounting=true</literal>.</para>
 256
 257           <para>This setting is supported only if the unified control group hierarchy is used and disables
 258           <varname>MemoryLimit=</varname>.</para>
 259         </listitem>
 260       </varlistentry>
 261
 262       <varlistentry>
 263         <term><varname>MemoryHigh=<replaceable>bytes</replaceable></varname></term>
 264
 265         <listitem>
 266           <para>Specify the high limit on memory usage of the executed processes in this unit. Memory usage may go
 267           above the limit if unavoidable, but the processes are heavily slowed down and memory is taken away
 268           aggressively in such cases. This is the main mechanism to control memory usage of a unit.</para>
 269
 270           <para>Takes a memory size in bytes. If the value is suffixed with K, M, G or T, the specified memory size is
 271           parsed as Kilobytes, Megabytes, Gigabytes, or Terabytes (with the base 1024), respectively. Alternatively, a
 272           percentage value may be specified, which is taken relative to the installed physical memory on the
 273           system. If assigned the
 274           special value <literal>infinity</literal>, no memory limit is applied. This controls the
 275           <literal>memory.high</literal> control group attribute. For details about this control group attribute, see
 276           <ulink url="https://www.kernel.org/doc/Documentation/cgroup-v2.txt">cgroup-v2.txt</ulink>.</para>
 277
 278           <para>Implies <literal>MemoryAccounting=true</literal>.</para>
 279
 280           <para>This setting is supported only if the unified control group hierarchy is used and disables
 281           <varname>MemoryLimit=</varname>.</para>
 282         </listitem>
 283       </varlistentry>
 284
 285       <varlistentry>
 286         <term><varname>MemoryMax=<replaceable>bytes</replaceable></varname></term>
 287
 288         <listitem>
 289           <para>Specify the absolute limit on memory usage of the executed processes in this unit. If memory usage
 290           cannot be contained under the limit, out-of-memory killer is invoked inside the unit. It is recommended to
 291           use <varname>MemoryHigh=</varname> as the main control mechanism and use <varname>MemoryMax=</varname> as the
 292           last line of defense.</para>
 293
 294           <para>Takes a memory size in bytes. If the value is suffixed with K, M, G or T, the specified memory size is
 295           parsed as Kilobytes, Megabytes, Gigabytes, or Terabytes (with the base 1024), respectively. Alternatively, a
 296           percentage value may be specified, which is taken relative to the installed physical memory on the system. If
 297           assigned the special value <literal>infinity</literal>, no memory limit is applied. This controls the
 298           <literal>memory.max</literal> control group attribute. For details about this control group attribute, see
 299           <ulink url="https://www.kernel.org/doc/Documentation/cgroup-v2.txt">cgroup-v2.txt</ulink>.</para>
 300
 301           <para>Implies <literal>MemoryAccounting=true</literal>.</para>
 302
 303           <para>This setting replaces <varname>MemoryLimit=</varname>.</para>
 304         </listitem>
 305       </varlistentry>
 306
 307       <varlistentry>
 308         <term><varname>MemorySwapMax=<replaceable>bytes</replaceable></varname></term>
 309
 310         <listitem>
 311           <para>Specify the absolute limit on swap usage of the executed processes in this unit.</para>
 312
 313           <para>Takes a swap size in bytes. If the value is suffixed with K, M, G or T, the specified swap size is
 314           parsed as Kilobytes, Megabytes, Gigabytes, or Terabytes (with the base 1024), respectively. If assigned the
 315           special value <literal>infinity</literal>, no swap limit is applied. This controls the
 316           <literal>memory.swap.max</literal> control group attribute. For details about this control group attribute,
 317           see <ulink url="https://www.kernel.org/doc/Documentation/cgroup-v2.txt">cgroup-v2.txt</ulink>.</para>
 318
 319           <para>Implies <literal>MemoryAccounting=true</literal>.</para>
 320
 321           <para>This setting is supported only if the unified control group hierarchy is used and disables
 322           <varname>MemoryLimit=</varname>.</para>
 323         </listitem>
 324       </varlistentry>
 325
 326       <varlistentry>
 327         <term><varname>TasksAccounting=</varname></term>
 328
 329         <listitem>
 330           <para>Turn on task accounting for this unit. Takes a
 331           boolean argument. If enabled, the system manager will keep
 332           track of the number of tasks in the unit. The number of
 333           tasks accounted this way includes both kernel threads and
 334           userspace processes, with each thread counting
 335           individually. Note that turning on tasks accounting for one
 336           unit will also implicitly turn it on for all units contained
 337           in the same slice and for all its parent slices and the
 338           units contained therein. The system default for this setting
 339           may be controlled with
 340           <varname>DefaultTasksAccounting=</varname> in
 341           <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
 342         </listitem>
 343       </varlistentry>
 344
 345       <varlistentry>
 346         <term><varname>TasksMax=<replaceable>N</replaceable></varname></term>
 347
 348         <listitem>
 349           <para>Specify the maximum number of tasks that may be created in the unit. This ensures that the number of
 350           tasks accounted for the unit (see above) stays below a specific limit. This either takes an absolute number
 351           of tasks or a percentage value that is taken relative to the configured maximum number of tasks on the
 352           system.  If assigned the special value <literal>infinity</literal>, no tasks limit is applied. This controls
 353           the <literal>pids.max</literal> control group attribute. For details about this control group attribute, see
 354           <ulink url="https://www.kernel.org/doc/Documentation/cgroup-v1/pids.txt">pids.txt</ulink>.</para>
 355
 356           <para>Implies <literal>TasksAccounting=true</literal>. The
 357           system default for this setting may be controlled with
 358           <varname>DefaultTasksMax=</varname> in
 359           <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
 360         </listitem>
 361       </varlistentry>
 362
 363       <varlistentry>
 364         <term><varname>IOAccounting=</varname></term>
 365
 366         <listitem>
 367           <para>Turn on Block I/O accounting for this unit, if the unified control group hierarchy is used on the
 368           system. Takes a boolean argument. Note that turning on block I/O accounting for one unit will also implicitly
 369           turn it on for all units contained in the same slice and all for its parent slices and the units contained
 370           therein. The system default for this setting may be controlled with <varname>DefaultIOAccounting=</varname>
 371           in
 372           <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
 373
 374           <para>This setting replaces <varname>BlockIOAccounting=</varname> and disables settings prefixed with
 375           <varname>BlockIO</varname> or <varname>StartupBlockIO</varname>.</para>
 376         </listitem>
 377       </varlistentry>
 378
 379       <varlistentry>
 380         <term><varname>IOWeight=<replaceable>weight</replaceable></varname></term>
 381         <term><varname>StartupIOWeight=<replaceable>weight</replaceable></varname></term>
 382
 383         <listitem>
 384           <para>Set the default overall block I/O weight for the executed processes, if the unified control group
 385           hierarchy is used on the system. Takes a single weight value (between 1 and 10000) to set the default block
 386           I/O weight. This controls the <literal>io.weight</literal> control group attribute, which defaults to
 387           100. For details about this control group attribute, see <ulink
 388           url="https://www.kernel.org/doc/Documentation/cgroup-v2.txt">cgroup-v2.txt</ulink>.  The available I/O
 389           bandwidth is split up among all units within one slice relative to their block I/O weight.</para>
 390
 391           <para>While <varname>StartupIOWeight=</varname> only applies
 392           to the startup phase of the system,
 393           <varname>IOWeight=</varname> applies to the later runtime of
 394           the system, and if the former is not set also to the startup
 395           phase. This allows prioritizing specific services at boot-up
 396           differently than during runtime.</para>
 397
 398           <para>Implies <literal>IOAccounting=true</literal>.</para>
 399
 400           <para>These settings replace <varname>BlockIOWeight=</varname> and <varname>StartupBlockIOWeight=</varname>
 401           and disable settings prefixed with <varname>BlockIO</varname> or <varname>StartupBlockIO</varname>.</para>
 402         </listitem>
 403       </varlistentry>
 404
 405       <varlistentry>
 406         <term><varname>IODeviceWeight=<replaceable>device</replaceable> <replaceable>weight</replaceable></varname></term>
 407
 408         <listitem>
 409           <para>Set the per-device overall block I/O weight for the executed processes, if the unified control group
 410           hierarchy is used on the system. Takes a space-separated pair of a file path and a weight value to specify
 411           the device specific weight value, between 1 and 10000. (Example: "/dev/sda 1000"). The file path may be
 412           specified as path to a block device node or as any other file, in which case the backing block device of the
 413           file system of the file is determined. This controls the <literal>io.weight</literal> control group
 414           attribute, which defaults to 100. Use this option multiple times to set weights for multiple devices. For
 415           details about this control group attribute, see <ulink
 416           url="https://www.kernel.org/doc/Documentation/cgroup-v2.txt">cgroup-v2.txt</ulink>.</para>
 417
 418           <para>Implies <literal>IOAccounting=true</literal>.</para>
 419
 420           <para>This setting replaces <varname>BlockIODeviceWeight=</varname> and disables settings prefixed with
 421           <varname>BlockIO</varname> or <varname>StartupBlockIO</varname>.</para>
 422         </listitem>
 423       </varlistentry>
 424
 425       <varlistentry>
 426         <term><varname>IOReadBandwidthMax=<replaceable>device</replaceable> <replaceable>bytes</replaceable></varname></term>
 427         <term><varname>IOWriteBandwidthMax=<replaceable>device</replaceable> <replaceable>bytes</replaceable></varname></term>
 428
 429         <listitem>
 430           <para>Set the per-device overall block I/O bandwidth maximum limit for the executed processes, if the unified
 431           control group hierarchy is used on the system. This limit is not work-conserving and the executed processes
 432           are not allowed to use more even if the device has idle capacity.  Takes a space-separated pair of a file
 433           path and a bandwidth value (in bytes per second) to specify the device specific bandwidth. The file path may
 434           be a path to a block device node, or as any other file in which case the backing block device of the file
 435           system of the file is used. If the bandwidth is suffixed with K, M, G, or T, the specified bandwidth is
 436           parsed as Kilobytes, Megabytes, Gigabytes, or Terabytes, respectively, to the base of 1000. (Example:
 437           "/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 5M"). This controls the <literal>io.max</literal> control
 438           group attributes. Use this option multiple times to set bandwidth limits for multiple devices. For details
 439           about this control group attribute, see <ulink
 440           url="https://www.kernel.org/doc/Documentation/cgroup-v2.txt">cgroup-v2.txt</ulink>.
 441           </para>
 442
 443           <para>Implies <literal>IOAccounting=true</literal>.</para>
 444
 445           <para>These settings replace <varname>BlockIOReadBandwidth=</varname> and
 446           <varname>BlockIOWriteBandwidth=</varname> and disable settings prefixed with <varname>BlockIO</varname> or
 447           <varname>StartupBlockIO</varname>.</para>
 448         </listitem>
 449       </varlistentry>
 450
 451       <varlistentry>
 452         <term><varname>IOReadIOPSMax=<replaceable>device</replaceable> <replaceable>IOPS</replaceable></varname></term>
 453         <term><varname>IOWriteIOPSMax=<replaceable>device</replaceable> <replaceable>IOPS</replaceable></varname></term>
 454
 455         <listitem>
 456           <para>Set the per-device overall block I/O IOs-Per-Second maximum limit for the executed processes, if the
 457           unified control group hierarchy is used on the system. This limit is not work-conserving and the executed
 458           processes are not allowed to use more even if the device has idle capacity.  Takes a space-separated pair of
 459           a file path and an IOPS value to specify the device specific IOPS. The file path may be a path to a block
 460           device node, or as any other file in which case the backing block device of the file system of the file is
 461           used. If the IOPS is suffixed with K, M, G, or T, the specified IOPS is parsed as KiloIOPS, MegaIOPS,
 462           GigaIOPS, or TeraIOPS, respectively, to the base of 1000. (Example:
 463           "/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 1K"). This controls the <literal>io.max</literal> control
 464           group attributes. Use this option multiple times to set IOPS limits for multiple devices. For details about
 465           this control group attribute, see <ulink
 466           url="https://www.kernel.org/doc/Documentation/cgroup-v2.txt">cgroup-v2.txt</ulink>.
 467           </para>
 468
 469           <para>Implies <literal>IOAccounting=true</literal>.</para>
 470
 471           <para>These settings are supported only if the unified control group hierarchy is used and disable settings
 472           prefixed with <varname>BlockIO</varname> or <varname>StartupBlockIO</varname>.</para>
 473         </listitem>
 474       </varlistentry>
 475
 476       <varlistentry>
 477         <term><varname>DeviceAllow=</varname></term>
 478
 479         <listitem>
 480           <para>Control access to specific device nodes by the
 481           executed processes. Takes two space-separated strings: a
 482           device node specifier followed by a combination of
 483           <constant>r</constant>, <constant>w</constant>,
 484           <constant>m</constant> to control
 485           <emphasis>r</emphasis>eading, <emphasis>w</emphasis>riting,
 486           or creation of the specific device node(s) by the unit
 487           (<emphasis>m</emphasis>knod), respectively. This controls
 488           the <literal>devices.allow</literal> and
 489           <literal>devices.deny</literal> control group
 490           attributes. For details about these control group
 491           attributes, see <ulink
 492           url="https://www.kernel.org/doc/Documentation/cgroup-v1/devices.txt">devices.txt</ulink>.</para>
 493
 494           <para>The device node specifier is either a path to a device
 495           node in the file system, starting with
 496           <filename>/dev/</filename>, or a string starting with either
 497           <literal>char-</literal> or <literal>block-</literal>
 498           followed by a device group name, as listed in
 499           <filename>/proc/devices</filename>. The latter is useful to
 500           whitelist all current and future devices belonging to a
 501           specific device group at once. The device group is matched
 502           according to file name globbing rules, you may hence use the
 503           <literal>*</literal> and <literal>?</literal>
 504           wildcards. Examples: <filename>/dev/sda5</filename> is a
 505           path to a device node, referring to an ATA or SCSI block
 506           device. <literal>char-pts</literal> and
 507           <literal>char-alsa</literal> are specifiers for all pseudo
 508           TTYs and all ALSA sound devices,
 509           respectively. <literal>char-cpu/*</literal> is a specifier
 510           matching all CPU related device groups.</para>
 511         </listitem>
 512       </varlistentry>
 513
 514       <varlistentry>
 515         <term><varname>DevicePolicy=auto|closed|strict</varname></term>
 516
 517         <listitem>
 518           <para>
 519             Control the policy for allowing device access:
 520           </para>
 521           <variablelist>
 522             <varlistentry>
 523               <term><option>strict</option></term>
 524               <listitem>
 525                 <para>means to only allow types of access that are
 526                 explicitly specified.</para>
 527               </listitem>
 528             </varlistentry>
 529
 530             <varlistentry>
 531               <term><option>closed</option></term>
 532               <listitem>
 533                 <para>in addition, allows access to standard pseudo
 534                 devices including
 535                 <filename>/dev/null</filename>,
 536                 <filename>/dev/zero</filename>,
 537                 <filename>/dev/full</filename>,
 538                 <filename>/dev/random</filename>, and
 539                 <filename>/dev/urandom</filename>.
 540                 </para>
 541               </listitem>
 542             </varlistentry>
 543
 544             <varlistentry>
 545               <term><option>auto</option></term>
 546               <listitem>
 547                 <para>
 548                   in addition, allows access to all devices if no
 549                   explicit <varname>DeviceAllow=</varname> is present.
 550                   This is the default.
 551                 </para>
 552               </listitem>
 553             </varlistentry>
 554           </variablelist>
 555         </listitem>
 556       </varlistentry>
 557
 558       <varlistentry>
 559         <term><varname>Slice=</varname></term>
 560
 561         <listitem>
 562           <para>The name of the slice unit to place the unit
 563           in. Defaults to <filename>system.slice</filename> for all
 564           non-instantiated units of all unit types (except for slice
 565           units themselves see below). Instance units are by default
 566           placed in a subslice of <filename>system.slice</filename>
 567           that is named after the template name.</para>
 568
 569           <para>This option may be used to arrange systemd units in a
 570           hierarchy of slices each of which might have resource
 571           settings applied.</para>
 572
 573           <para>For units of type slice, the only accepted value for
 574           this setting is the parent slice. Since the name of a slice
 575           unit implies the parent slice, it is hence redundant to ever
 576           set this parameter directly for slice units.</para>
 577
 578           <para>Special care should be taken when relying on the default slice assignment in templated service units
 579           that have <varname>DefaultDependencies=no</varname> set, see
 580           <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>, section
 581           "Automatic Dependencies" for details.</para>
 582
 583         </listitem>
 584       </varlistentry>
 585
 586       <varlistentry>
 587         <term><varname>Delegate=</varname></term>
 588
 589         <listitem>
 590           <para>Turns on delegation of further resource control
 591           partitioning to processes of the unit. For unprivileged
 592           services (i.e. those using the <varname>User=</varname>
 593           setting), this allows processes to create a subhierarchy
 594           beneath its control group path. For privileged services and
 595           scopes, this ensures the processes will have all control
 596           group controllers enabled.</para>
 597         </listitem>
 598       </varlistentry>
 599
 600     </variablelist>
 601   </refsect1>
 602
 603   <refsect1>
 604     <title>Deprecated Options</title>
 605
 606     <para>The following options are deprecated. Use the indicated superseding options instead:</para>
 607
 608     <variablelist class='unit-directives'>
 609
 610       <varlistentry>
 611         <term><varname>CPUShares=<replaceable>weight</replaceable></varname></term>
 612         <term><varname>StartupCPUShares=<replaceable>weight</replaceable></varname></term>
 613
 614         <listitem>
 615           <para>Assign the specified CPU time share weight to the processes executed. These options take an integer
 616           value and control the <literal>cpu.shares</literal> control group attribute. The allowed range is 2 to
 617           262144. Defaults to 1024. For details about this control group attribute, see <ulink
 618           url="https://www.kernel.org/doc/Documentation/scheduler/sched-design-CFS.txt">sched-design-CFS.txt</ulink>.
 619           The available CPU time is split up among all units within one slice relative to their CPU time share
 620           weight.</para>
 621
 622           <para>While <varname>StartupCPUShares=</varname> only applies to the startup phase of the system,
 623           <varname>CPUShares=</varname> applies to normal runtime of the system, and if the former is not set also to
 624           the startup phase. Using <varname>StartupCPUShares=</varname> allows prioritizing specific services at
 625           boot-up differently than during normal runtime.</para>
 626
 627           <para>Implies <literal>CPUAccounting=true</literal>.</para>
 628
 629           <para>These settings are deprecated. Use <varname>CPUWeight=</varname> and
 630           <varname>StartupCPUWeight=</varname> instead.</para>
 631         </listitem>
 632       </varlistentry>
 633
 634       <varlistentry>
 635         <term><varname>MemoryLimit=<replaceable>bytes</replaceable></varname></term>
 636
 637         <listitem>
 638           <para>Specify the limit on maximum memory usage of the executed processes. The limit specifies how much
 639           process and kernel memory can be used by tasks in this unit. Takes a memory size in bytes. If the value is
 640           suffixed with K, M, G or T, the specified memory size is parsed as Kilobytes, Megabytes, Gigabytes, or
 641           Terabytes (with the base 1024), respectively. Alternatively, a percentage value may be specified, which is
 642           taken relative to the installed physical memory on the system. If assigned the special value
 643           <literal>infinity</literal>, no memory limit is applied. This controls the
 644           <literal>memory.limit_in_bytes</literal> control group attribute. For details about this control group
 645           attribute, see <ulink
 646           url="https://www.kernel.org/doc/Documentation/cgroup-v1/memory.txt">memory.txt</ulink>.</para>
 647
 648           <para>Implies <literal>MemoryAccounting=true</literal>.</para>
 649
 650           <para>This setting is deprecated. Use <varname>MemoryMax=</varname> instead.</para>
 651         </listitem>
 652       </varlistentry>
 653
 654       <varlistentry>
 655         <term><varname>BlockIOAccounting=</varname></term>
 656
 657         <listitem>
 658           <para>Turn on Block I/O accounting for this unit, if the legacy control group hierarchy is used on the
 659           system. Takes a boolean argument. Note that turning on block I/O accounting for one unit will also implicitly
 660           turn it on for all units contained in the same slice and all for its parent slices and the units contained
 661           therein. The system default for this setting may be controlled with
 662           <varname>DefaultBlockIOAccounting=</varname> in
 663           <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
 664
 665           <para>This setting is deprecated. Use <varname>IOAccounting=</varname> instead.</para>
 666         </listitem>
 667       </varlistentry>
 668
 669       <varlistentry>
 670         <term><varname>BlockIOWeight=<replaceable>weight</replaceable></varname></term>
 671         <term><varname>StartupBlockIOWeight=<replaceable>weight</replaceable></varname></term>
 672
 673         <listitem><para>Set the default overall block I/O weight for the executed processes, if the legacy control
 674         group hierarchy is used on the system. Takes a single weight value (between 10 and 1000) to set the default
 675         block I/O weight. This controls the <literal>blkio.weight</literal> control group attribute, which defaults to
 676         500. For details about this control group attribute, see <ulink
 677         url="https://www.kernel.org/doc/Documentation/cgroup-v1/blkio-controller.txt">blkio-controller.txt</ulink>.
 678         The available I/O bandwidth is split up among all units within one slice relative to their block I/O
 679         weight.</para>
 680
 681         <para>While <varname>StartupBlockIOWeight=</varname> only
 682         applies to the startup phase of the system,
 683         <varname>BlockIOWeight=</varname> applies to the later runtime
 684         of the system, and if the former is not set also to the
 685         startup phase. This allows prioritizing specific services at
 686         boot-up differently than during runtime.</para>
 687
 688         <para>Implies
 689         <literal>BlockIOAccounting=true</literal>.</para>
 690
 691         <para>These settings are deprecated. Use <varname>IOWeight=</varname> and <varname>StartupIOWeight=</varname>
 692         instead.</para>
 693
 694       </listitem>
 695       </varlistentry>
 696
 697       <varlistentry>
 698         <term><varname>BlockIODeviceWeight=<replaceable>device</replaceable> <replaceable>weight</replaceable></varname></term>
 699
 700         <listitem>
 701           <para>Set the per-device overall block I/O weight for the executed processes, if the legacy control group
 702           hierarchy is used on the system. Takes a space-separated pair of a file path and a weight value to specify
 703           the device specific weight value, between 10 and 1000. (Example: "/dev/sda 500"). The file path may be
 704           specified as path to a block device node or as any other file, in which case the backing block device of the
 705           file system of the file is determined. This controls the <literal>blkio.weight_device</literal> control group
 706           attribute, which defaults to 1000. Use this option multiple times to set weights for multiple devices. For
 707           details about this control group attribute, see <ulink
 708           url="https://www.kernel.org/doc/Documentation/cgroup-v1/blkio-controller.txt">blkio-controller.txt</ulink>.</para>
 709
 710           <para>Implies
 711           <literal>BlockIOAccounting=true</literal>.</para>
 712
 713           <para>This setting is deprecated. Use <varname>IODeviceWeight=</varname> instead.</para>
 714         </listitem>
 715       </varlistentry>
 716
 717       <varlistentry>
 718         <term><varname>BlockIOReadBandwidth=<replaceable>device</replaceable> <replaceable>bytes</replaceable></varname></term>
 719         <term><varname>BlockIOWriteBandwidth=<replaceable>device</replaceable> <replaceable>bytes</replaceable></varname></term>
 720
 721         <listitem>
 722           <para>Set the per-device overall block I/O bandwidth limit for the executed processes, if the legacy control
 723           group hierarchy is used on the system. Takes a space-separated pair of a file path and a bandwidth value (in
 724           bytes per second) to specify the device specific bandwidth. The file path may be a path to a block device
 725           node, or as any other file in which case the backing block device of the file system of the file is used. If
 726           the bandwidth is suffixed with K, M, G, or T, the specified bandwidth is parsed as Kilobytes, Megabytes,
 727           Gigabytes, or Terabytes, respectively, to the base of 1000. (Example:
 728           "/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 5M"). This controls the
 729           <literal>blkio.throttle.read_bps_device</literal> and <literal>blkio.throttle.write_bps_device</literal>
 730           control group attributes. Use this option multiple times to set bandwidth limits for multiple devices. For
 731           details about these control group attributes, see <ulink
 732           url="https://www.kernel.org/doc/Documentation/cgroup-v1/blkio-controller.txt">blkio-controller.txt</ulink>.
 733           </para>
 734
 735           <para>Implies
 736           <literal>BlockIOAccounting=true</literal>.</para>
 737
 738           <para>These settings are deprecated. Use <varname>IOReadBandwidthMax=</varname> and
 739           <varname>IOWriteBandwidthMax=</varname> instead.</para>
 740         </listitem>
 741       </varlistentry>
 742
 743     </variablelist>
 744   </refsect1>
 745
 746   <refsect1>
 747     <title>See Also</title>
 748     <para>
 749       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 750       <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 751       <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 752       <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 753       <citerefentry><refentrytitle>systemd.scope</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 754       <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 755       <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 756       <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 757       <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 758       <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 759       <citerefentry><refentrytitle>systemd.special</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 760       The documentation for control groups and specific controllers in the Linux kernel:
 761       <ulink url="https://www.kernel.org/doc/Documentation/cgroup-v1/cgroups.txt">cgroups.txt</ulink>,
 762       <ulink url="https://www.kernel.org/doc/Documentation/cgroup-v1/cpuacct.txt">cpuacct.txt</ulink>,
 763       <ulink url="https://www.kernel.org/doc/Documentation/cgroup-v1/memory.txt">memory.txt</ulink>,
 764       <ulink url="https://www.kernel.org/doc/Documentation/cgroup-v1/blkio-controller.txt">blkio-controller.txt</ulink>.
 765     </para>
 766   </refsect1>
 767 </refentry>