Verifying Cgroup v2 Support in OpenJDK Images

Environment

• Red Hat OpenShift Container Platform (RHOCP)
  • 4.12+
• OpenJDK
  • 8u372+
  • 11.0.16+
  • any JDK 17+

Issue

• How can users determine if their Java container image supports cgroup v2?
• Is it possible to check if image registry.access.redhat.com/ubi8/openjdk-8:1.15-1.1682399183, has the fix for cgroupv2?

Resolution

As explained on Cgroups v2 in OpenJDK container in Openshift 4, 8u372, 11.0.16, any version after 17 is CGv2 compatible.
And failure to detect cgv2 will result in the container settings/boundaries not being detected and the host being used as boundaries,

To verify: Run the Java container image, Check the Java version and system settings:

$ podman run -it registry.access.redhat.com/ubi8/openjdk-8:1.15-1.1682399183 java -XshowSettings:system -version
Operating System Metrics:
    Provider: cgroupv2  <---------------------------------
    Effective CPU Count: 1
    CPU Period: 100000us
    CPU Quota: -1
    CPU Shares: -1
    List of Processors: N/A
    List of Effective Processors: N/A
    List of Memory Nodes: N/A
    List of Available Memory Nodes: N/A
    Memory Limit: Unlimited
    Memory Soft Limit: 0.00K
    Memory & Swap Limit: Unlimited

openjdk version "1.8.0_372"
OpenJDK Runtime Environment (build 1.8.0_372-b07)
OpenJDK 64-Bit Server VM (build 25.372-b07, mixed mode)

Note: Replace registry.access.redhat.com/ubi8/openjdk-8:1.15-1.1682399183 with any OpenJDK version you would like to verify.

If the output includes "Provider: cgroupv2", it indicates that the Java version in the container supports cgroup v2.

Root Cause

As explained on Cgroups v2 in OpenJDK container in Openshift 4, cgroups v2 compatbile have been released in the following release: 8u372+ (April 2023), 11.0.16+, and any JDK 17 (or later release).
Using a version later than that will make Java detect the cgroup version 2(cgv2) from the container limits and the JVM adjust its internal resources based on the set resource limits accordingly.

Whereas, older releases of OpenJDK 8u, such as 8u362, will only detect cgroup v1 systems - failure to detect the container limits will use the host limits are reference. Therefore, if running containers in OpenShift 4.12+, it's recommended to upgrade to OpenJDK 8u372+ or later.

Diagnostic Steps

To verify if the Java version in a container supports cgroup v2:

1. Run the command:

java -XshowSettings:system -version

2. Check the output for the line "Provider: cgroupv2". If present, the Java version supports cgroup v2.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.