What are web-interface-resource-limiting-modes?

Issue

What are web-interface-resource-limiting-modes?

Environment

• CloudLinux
• web-interface-resource-limiting-modes

Solution

web-interface-resource-limiting-modes are the ability to manage the limiting modes of user processes started from the web interface (e.g. Node.js, Ruby and Python Selectors). The configuration allows for disabling LVE limiting for some commands or not limit web commands at all.

The web_resource_limit_mode parameter can be added to any section of the /etc/sysconfig/cloudlinux configuration file for convenience 

Example of Adding the Parameter to Existing Sections:

[license_check]
email = CP`
cpanel_getemail_script = /usr/share/cloudlinux/clgetcpanelemail
plesk_getemail_script = /usr/share/cloudlinux/clgetpleskemail
web_resource_limit_mode = unlimited

[cldiag_cron]
disabled_cldiag_cron_checkers = check-usepam
web_resource_limit_mode = all

[custom_section]
web_resource_limit_mode = unlimited <--------------

The "web_resource_limit_mode" parameter is used to control how user processes started from the web interface (such as Node.js) are limited in terms of resources. This setting determines whether these processes are subject to LVE limits.

Possible values and their Impact are as follows.

• all (default option): All processes will run inside CageFS with LVE limits applied.

This is the most secure and resource-controlled setting. It ensures that all user processes are isolated and subject to resource limits like CPU, IO, memory, and NPROC. This helps prevent any single user from consuming excessive resources and affecting other users on the server.

• heavy: A predefined list of lightweight processes will run inside CageFS without resource limits.

This mode allows certain lightweight processes to bypass resource limits temporarily. It's designed to ensure that essential operations can continue even if a user hits their resource limits.

• unlimited: All processes will run inside CageFS but will ignore CPU, IO, memory, and NPROC limits.

This setting effectively removes resource restrictions for processes started from the web interface. While it might be useful for testing or specific scenarios, it is not recommended for production environments because it can lead to resource abuse, where a single user could potentially consume all available resources, impacting server performance and stability.

Useful links

https://docs.cloudlinux.com/cloudlinuxos/limits/#web-interface-resource-limiting-modes

https://cloudlinux.zendesk.com/hc/en-us/articles/19754174190620-Persistent-Node-js-Process-Issues-When-Stopped-Doesn-t-Mean-Stopped