allow user defined ulimits

salt/docker/defaults.yaml

@@ -2,8 +2,9 @@ docker:
   range: '172.17.1.0/24'
   gateway: '172.17.1.1'
   ulimits:
-    soft: 1048576
+    - name: nofile
-    hard: 1048576
+      soft: 1048576
+      hard: 1048576
   containers:
     'so-dockerregistry':
       final_octet: 20
@@ -30,9 +31,15 @@ docker:
       extra_hosts: []
       extra_env: []
       ulimits:
-        - memlock=-1:-1
+        - name: memlock
-        - nofile=65536:65536
+          soft: -1
-        - nproc=4096
+          hard: -1
+        - name: nofile
+          soft: 65536
+          hard: 65536
+        - name: nproc
+          soft: 4096
+          hard: 4096
     'so-influxdb':
       final_octet: 26
       port_bindings:
@@ -210,15 +217,21 @@ docker:
       extra_hosts: []
       extra_env: []
       ulimits:
-        - memlock=524288000
+        - name: memlock
+          soft: 524288000
+          hard: 524288000
     'so-zeek':
       final_octet: 99
       custom_bind_mounts: []
       extra_hosts: []
       extra_env: []
       ulimits:
-        - core=0
+        - name: core
-        - nofile=1048576:1048576
+          soft: 0
+          hard: 0
+        - name: nofile
+          soft: 1048576
+          hard: 1048576
     'so-kafka':
       final_octet: 88
       port_bindings:

salt/docker/files/daemon.json

@@ -1,19 +0,0 @@
-{
-  "registry-mirrors": [
-    "https://:5000"
-  ],
-  "bip": "172.17.0.1/24",
-  "default-address-pools": [
-    {
-      "base": "172.17.0.0/24",
-      "size": 24
-    }
-  ],
-  "default-ulimits": {
-      "nofile": {
-        "Name": "nofile",
-        "Soft": 1048576,
-        "Hard": 1048576
-      }
-  }
-}

salt/docker/files/daemon.json.jinja

@@ -0,0 +1,24 @@
+{% from 'docker/docker.map.jinja' import DOCKERMERGED -%}
+{
+  "registry-mirrors": [
+    "https://:5000"
+  ],
+  "bip": "172.17.0.1/24",
+  "default-address-pools": [
+    {
+      "base": "172.17.0.0/24",
+      "size": 24
+    }
+  ]
+{%- if DOCKERMERGED.ulimits %},
+  "default-ulimits": {
+{%-   for ULIMIT in DOCKERMERGED.ulimits %}
+    "{{ ULIMIT.name }}": {
+      "Name": "{{ ULIMIT.name }}",
+      "Soft": {{ ULIMIT.soft }},
+      "Hard": {{ ULIMIT.hard }}
+    }{{ "," if not loop.last else "" }}
+{%-   endfor %}
+  }
+{%- endif %}
+}

salt/docker/init.sls

@@ -41,11 +41,11 @@ dockeretc:
   file.directory:
     - name: /etc/docker
 
-# Manager daemon.json
+# Manager daemon.json.jinja
 docker_daemon:
   file.managed:
-    - source: salt://docker/files/daemon.json
+    - source: salt://docker/files/daemon.json.jinja
-    - name: /etc/docker/daemon.json
+    - name: /etc/docker/daemon.json.jinja
     - template: jinja 
 
 # Make sure Docker is always running

salt/docker/soc_docker.yaml

@@ -7,6 +7,22 @@ docker:
     description: Default docker IP range for containers.
     helpLink: docker.html
     advanced: True
+  ulimits:
+    description: Default ulimit settings applied to all containers via the Docker daemon. Each entry specifies a resource name (e.g. nofile, memlock, core, nproc) with soft and hard limits. Individual container ulimits override these defaults.
+    forcedType: "[]{}"
+    syntax: json
+    advanced: True
+    helpLink: docker.html
+    uiElements:
+    - field: name
+      label: Resource Name
+      required: True
+    - field: soft
+      label: Soft Limit
+      forcedType: int
+    - field: hard
+      label: Hard Limit
+      forcedType: int
   containers:
     so-dockerregistry: &dockerOptions
       final_octet:
@@ -40,11 +56,21 @@ docker:
         multiline: True
         forcedType: "[]string"
       ulimits:
-        description: Ulimits for the container.
+        description: Ulimit settings for the container. Each entry specifies a resource name (e.g. nofile, memlock, core, nproc) with optional soft and hard limits.
         advanced: True
         helpLink: docker.html
-        multiline: True
+        forcedType: "[]{}"
-        forcedType: "[]string"
+        syntax: json
+        uiElements:
+        - field: name
+          label: Resource Name
+          required: True
+        - field: soft
+          label: Soft Limit
+          forcedType: int
+        - field: hard
+          label: Hard Limit
+          forcedType: int
     so-elastic-fleet: *dockerOptions
     so-elasticsearch: *dockerOptions
     so-influxdb: *dockerOptions

salt/elastalert/enabled.sls

@@ -54,7 +54,7 @@ so-elastalert:
     {% if DOCKERMERGED.containers['so-elastalert'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-elastalert'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - require:

salt/elastic-fleet-package-registry/enabled.sls

@@ -48,7 +48,7 @@ so-elastic-fleet-package-registry:
     {% if DOCKERMERGED.containers['so-elastic-fleet-package-registry'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-elastic-fleet-package-registry'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
 delete_so-elastic-fleet-package-registry_so-status.disabled:

salt/elasticagent/enabled.sls

@@ -57,7 +57,7 @@ so-elastic-agent:
     {% if DOCKERMERGED.containers['so-elastic-agent'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-elastic-agent'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - require:

salt/elasticfleet/enabled.sls

@@ -136,7 +136,7 @@ so-elastic-fleet:
     {% if DOCKERMERGED.containers['so-elastic-fleet'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-elastic-fleet'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - watch:

salt/elasticsearch/enabled.sls

@@ -53,7 +53,7 @@ so-elasticsearch:
     {% if DOCKERMERGED.containers['so-elasticsearch'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-elasticsearch'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - port_bindings:

salt/hydra/enabled.sls

@@ -55,7 +55,7 @@ so-hydra:
     {% if DOCKERMERGED.containers['so-hydra'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-hydra'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - restart_policy: unless-stopped

salt/idh/enabled.sls

@@ -42,7 +42,7 @@ so-idh:
     {% if DOCKERMERGED.containers['so-idh'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-idh'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - watch:

salt/influxdb/enabled.sls

@@ -61,7 +61,7 @@ so-influxdb:
     {% if DOCKERMERGED.containers['so-influxdb'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-influxdb'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - watch:

salt/kafka/enabled.sls

@@ -63,7 +63,7 @@ so-kafka:
     {% if DOCKERMERGED.containers['so-kafka'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-kafka'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - watch:

salt/kibana/enabled.sls

@@ -54,7 +54,7 @@ so-kibana:
     {% if DOCKERMERGED.containers['so-kibana'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-kibana'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - watch:

salt/kratos/enabled.sls

@@ -48,7 +48,7 @@ so-kratos:
     {% if DOCKERMERGED.containers['so-kratos'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-kratos'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - restart_policy: unless-stopped

salt/logstash/enabled.sls

@@ -99,7 +99,7 @@ so-logstash:
     {% if DOCKERMERGED.containers['so-logstash'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-logstash'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - watch:

salt/nginx/enabled.sls

@@ -78,7 +78,7 @@ so-nginx:
     {% if DOCKERMERGED.containers[container_config].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers[container_config].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - cap_add: NET_BIND_SERVICE

salt/redis/enabled.sls

@@ -54,7 +54,7 @@ so-redis:
     {% if DOCKERMERGED.containers['so-redis'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-redis'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - entrypoint: "redis-server /usr/local/etc/redis/redis.conf"

salt/registry/enabled.sls

@@ -54,7 +54,7 @@ so-dockerregistry:
     {% if DOCKERMERGED.containers['so-dockerregistry'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-dockerregistry'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - retry:

salt/sensoroni/enabled.sls

@@ -43,7 +43,7 @@ so-sensoroni:
     {% if DOCKERMERGED.containers['so-sensoroni'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-sensoroni'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - watch:

salt/soc/enabled.sls

@@ -81,7 +81,7 @@ so-soc:
     {% if DOCKERMERGED.containers['so-soc'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-soc'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - watch:

salt/strelka/backend/enabled.sls

@@ -44,7 +44,7 @@ strelka_backend:
     {% if DOCKERMERGED.containers['so-strelka-backend'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-strelka-backend'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - restart_policy: on-failure

salt/strelka/coordinator/enabled.sls

@@ -47,7 +47,7 @@ strelka_coordinator:
     {% if DOCKERMERGED.containers['so-strelka-coordinator'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-strelka-coordinator'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
 delete_so-strelka-coordinator_so-status.disabled:

salt/strelka/filestream/enabled.sls

@@ -44,7 +44,7 @@ strelka_filestream:
     {% if DOCKERMERGED.containers['so-strelka-filestream'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-strelka-filestream'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - watch:

salt/strelka/frontend/enabled.sls

@@ -49,7 +49,7 @@ strelka_frontend:
     {% if DOCKERMERGED.containers['so-strelka-frontend'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-strelka-frontend'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - watch:

salt/strelka/gatekeeper/enabled.sls

@@ -47,7 +47,7 @@ strelka_gatekeeper:
     {% if DOCKERMERGED.containers['so-strelka-gatekeeper'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-strelka-gatekeeper'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
 

salt/strelka/manager/enabled.sls

@@ -43,7 +43,7 @@ strelka_manager:
     {% if DOCKERMERGED.containers['so-strelka-manager'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-strelka-manager'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - watch:

salt/suricata/enabled.sls

@@ -29,7 +29,7 @@ so-suricata:
     {% if SURICATAMERGED.config['af-packet'][0]['mmap-locked'] == "yes" and DOCKERMERGED.containers['so-suricata'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-suricata'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - binds:

salt/telegraf/enabled.sls

@@ -69,7 +69,7 @@ so-telegraf:
     {% if DOCKERMERGED.containers['so-telegraf'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-telegraf'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - watch:

salt/zeek/enabled.sls

@@ -21,7 +21,7 @@ so-zeek:
     {% if DOCKERMERGED.containers['so-zeek'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-zeek'].ulimits %}
-      - {{ ULIMIT }}
+      - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
     - binds: