Avoid using too many containers

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Avoid using too many containers

L4 Transporter


We're trying to avoid using too many containers. In order to reduce it, we have come up with two options for the automation:

  • Use the exact same container for automations (If they use the same libraries)
  • Or use the empty "Docker image name" option (if an external library is not used):


Which of them will fit better?







L3 Networker

Hi @Josep , I would love to understand what led you to want to limit containers. You can reference these Docker Server Configurations, particularly the containers.high.water.mark to understand how Cortex XSOAR handles containers per docker image. You may change this from the default of 20 to a lower number if you wish. The way to avoid docker memory issues would be through utilizing docker hardening. You can find detailed steps to do so here - https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Docker...



L3 Networker

@amore we host 30 tenants in 3 hosts. Each host has more than 500 containers. I followed the documentation and restarted docker service and after that it dropped to 200s. Is an additional host the best way to handle all the these loads? Any other recommendation is greatly appreciated









L3 Networker

Hi @EnesOzdemir , 200 containers is still high. Are your hosts meeting the MT sizing requirements stated here? The general recommendation is 1 tenant per host. If you have multiple tenants on a single host, you need to multiply the single tenant requirement by the times of tenants to find the host resource requirements. Highly recommend keeping the master in it's own host. For more detailed guidance please reach out to your Customer Success Architect available through our Premium Success offering.

We'd like to use fewer containers in order to control the containers perfomance. It's supposed not to use more than 200 ones. So the point is to try to create containers that can execute many automations/tasks without creating new ones.

We are constantly checking the resource usage and adding more resources as additional tenants are created.High container count is something we can't get rid of. Does the container count matter if you have enough resources?

L3 Networker

Hi Josep,


Just following up on the previous suggestion. The containers.high.water.mark configuration adds an upper limit to the number of containers per image that will remain active and containers.low.water.mark is the corresponding lower limit. This means that at any point, there will be a number of active containers that correspond to the low water mark, in order to avoid the overhead of cold starting the container. Depending on your use cases, the containers required to process them may also vary with respect to dependencies. So, a single image solution is not the most effective one. 

As per the previous recommendation, I would start by hardening docker (https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Docker...) to keep docker in check.

  • 6 replies
  • 31 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!