topic Re: Avoid using too many containers in Cortex XSOAR Discussions

Avoid using too many containers

Josep — Tue, 28 Mar 2023 07:53:52 GMT

Hello,

We're trying to avoid using too many containers. In order to reduce it, we have come up with two options for the automation:

Use the exact same container for automations (If they use the same libraries)
Or use the empty "Docker image name" option (if an external library is not used):

Which of them will fit better?

Thanks,

Josep

Re: Avoid using too many containers

amore — Tue, 11 Apr 2023 19:18:22 GMT

Hi @Josep , I would love to understand what led you to want to limit containers. You can reference these Docker Server Configurations, particularly the containers.high.water.mark to understand how Cortex XSOAR handles containers per docker image. You may change this from the default of 20 to a lower number if you wish. The way to avoid docker memory issues would be through utilizing docker hardening. You can find detailed steps to do so here - https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Docker-Hardening-Guide

Re: Avoid using too many containers

EnesOzdemir — Wed, 12 Apr 2023 10:53:46 GMT

@amore we host 30 tenants in 3 hosts. Each host has more than 500 containers. I followed the documentation and restarted docker service and after that it dropped to 200s. Is an additional host the best way to handle all the these loads? Any other recommendation is greatly appreciated

Re: Avoid using too many containers

amore — Wed, 12 Apr 2023 16:36:59 GMT

Hi @EnesOzdemir , 200 containers is still high. Are your hosts meeting the MT sizing requirements stated here? The general recommendation is 1 tenant per host. If you have multiple tenants on a single host, you need to multiply the single tenant requirement by the times of tenants to find the host resource requirements. Highly recommend keeping the master in it's own host. For more detailed guidance please reach out to your Customer Success Architect available through our Premium Success offering.

Re: Avoid using too many containers

Josep — Thu, 13 Apr 2023 18:34:04 GMT

We'd like to use fewer containers in order to control the containers perfomance. It's supposed not to use more than 200 ones. So the point is to try to create containers that can execute many automations/tasks without creating new ones.

Re: Avoid using too many containers

EnesOzdemir — Wed, 19 Apr 2023 07:18:12 GMT

We are constantly checking the resource usage and adding more resources as additional tenants are created.High container count is something we can't get rid of. Does the container count matter if you have enough resources?

Re: Avoid using too many containers

RahulVijaydev — Wed, 19 Apr 2023 18:41:12 GMT

Hi Josep,

Just following up on the previous suggestion. The containers.high.water.mark configuration adds an upper limit to the number of containers per image that will remain active and containers.low.water.mark is the corresponding lower limit. This means that at any point, there will be a number of active containers that correspond to the low water mark, in order to avoid the overhead of cold starting the container. Depending on your use cases, the containers required to process them may also vary with respect to dependencies. So, a single image solution is not the most effective one.

As per the previous recommendation, I would start by hardening docker (https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Docker-Hardening-Guide) to keep docker in check.