Processes in "podman build" have lower file descriptor limit than processes in "podman run", how can I increase this?

Question

I'm running podman 3.4.4 on Ubuntu 22.04 LTS server.

I have been having podman build issues that are not reproducible if I do those steps after the container build using podman run.

Eventually I traced it to this: the limits given to processes in podman build are completely different. Here's a sample Dockerfile:

FROM node:14-bullseye
WORKDIR /app
RUN echo "clear cache 1"
RUN bash -c 'cat /proc/$$/limits'
# Placeholder, not used in this example
CMD bash

If I run:

podman build -t project .

This prints (among other things):

Max open files            1024                 1024                 files     

Gee, that's low.

If I become root in my shell and use ulimit -n 131072, then cat /proc/self/limits shows my increased limit in the shell. But if I then bump "Clear cache 1" to "Clear cache 2" in the Dockerfile (this is important) and run the build command, still in that root shell with the increased ulimit, I still get:

Max open files            1024                 1024                 files     

So that's what I see in podman build. However if I then open a bash shell in a container using the new image using podman run, I get this result:

root@ubuntu:/home/ubuntu/opt/cloud/build# podman run -it project bash
root@17961323a1c9:/app# cat /proc/$$/limits
Max open files            1048576              1048576              files     

The command has completely different results at build time and at "run" time.

I did try to modify ulimit inside a RUN statement, but no dice:

bash: line 1: ulimit: open files: cannot modify limit: Operation not permitted
Error: error building at STEP "RUN bash -c 'ulimit -n 131072 && cat /proc/$$/lim

Anyway it would be much better to increase this for the build command in general, or at least using an option to it, rather than for every RUN that might need it.

Practically speaking this appears to be behind a build failure I have with a larger Dockerfile, but I've boiled it down to this straightforward test case.

I have also tried using docker (real Docker Engine). The problem does not happen with Docker Engine, I get 1048576 files there during build.

How can I increase the file descriptor limit at build time?

Thank you!

Update: I'm told there is a --ulimit option to podman, and indeed there is. But podman 3.4.4, which is standard on Ubuntu 22.04, does not support the simple --ulimit=host version. I am trying to figure out what a valid option value looks like. I have tried:

--ulimit=n=131072:1048576
--ulimit=NOFILES=131072:1048576

Both throw errors of the form:

requires name=SOFT:HARD, failed to be parsed: invalid ulimit type: n

Answer 1

The following command works, cobbled together from friendly advice and additional googling based on that input:

podman build --ulimit=nofile=131072:1048576 [other arguments here]

The latest releases of podman accept --ulimit=host, which is convenient if you want the same policy, but 3.4.4 does not, and in any case --ulimit=host works only for podman create and podman run. For podman build specifying limit names is a requirement.

For the file descriptor limit the proper name is nofiles. The podman documentation for version 4.4 describes additional valid limit names.

Answer 2

To permanently raise the default ulimit, it's now possible to edit /etc/containers/containers.conf (or the same file at various other locations; see man containers.conf):

Something like this:

[containers]
default_ulimits = [
  "nofile=16384:524288",
]