Configure Linux kernel parameters for container workloads with sysctl optimization

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Configuration
SYSCTL_CONFIG="/etc/sysctl.d/99-container-optimization.conf"
BACKUP_DIR="/opt/sysctl-backup-$(date +%Y%m%d-%H%M%S)"

# Usage
usage() {
    echo "Usage: $0 [OPTIONS]"
    echo "Options:"
    echo "  --skip-backup    Skip backing up current sysctl configuration"
    echo "  --dry-run        Show what would be done without making changes"
    echo "  -h, --help       Show this help message"
}

# Parse arguments
SKIP_BACKUP=false
DRY_RUN=false

while [[ $# -gt 0 ]]; do
    case $1 in
        --skip-backup)
            SKIP_BACKUP=true
            shift
            ;;
        --dry-run)
            DRY_RUN=true
            shift
            ;;
        -h|--help)
            usage
            exit 0
            ;;
        *)
            echo -e "${RED}Unknown option: $1${NC}"
            usage
            exit 1
            ;;
    esac
done

# Error handler
cleanup() {
    echo -e "${RED}Installation failed. Check logs above for details.${NC}"
    if [[ -d "$BACKUP_DIR" ]]; then
        echo -e "${YELLOW}Backup directory available at: $BACKUP_DIR${NC}"
    fi
}

trap cleanup ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}This script must be run as root${NC}"
    exit 1
fi

echo -e "${GREEN}Container Workload Kernel Parameter Optimization${NC}"
echo "=============================================="

# Auto-detect distribution
echo -e "${YELLOW}[1/8] Detecting distribution...${NC}"
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update"
            ;;
        almalinux|rocky|centos|rhel|ol)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            ;;
        fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            ;;
        *)
            echo -e "${RED}Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
    echo -e "${GREEN}Detected: $PRETTY_NAME${NC}"
else
    echo -e "${RED}Cannot detect distribution${NC}"
    exit 1
fi

# Check prerequisites
echo -e "${YELLOW}[2/8] Checking prerequisites...${NC}"
if ! command -v sysctl >/dev/null 2>&1; then
    echo -e "${RED}sysctl command not found${NC}"
    exit 1
fi

# Backup current configuration
if [[ "$SKIP_BACKUP" == "false" ]]; then
    echo -e "${YELLOW}[3/8] Backing up current sysctl configuration...${NC}"
    if [[ "$DRY_RUN" == "false" ]]; then
        mkdir -p "$BACKUP_DIR"
        sysctl -a > "$BACKUP_DIR/sysctl-all.backup" 2>/dev/null || true
        if [[ -d /etc/sysctl.d ]]; then
            cp -r /etc/sysctl.d "$BACKUP_DIR/" 2>/dev/null || true
        fi
        echo -e "${GREEN}Backup created at: $BACKUP_DIR${NC}"
    fi
else
    echo -e "${YELLOW}[3/8] Skipping backup as requested...${NC}"
fi

# Display current values
echo -e "${YELLOW}[4/8] Checking current kernel parameters...${NC}"
echo "Current key parameter values:"
echo "  vm.swappiness: $(sysctl -n vm.swappiness 2>/dev/null || echo 'N/A')"
echo "  net.core.somaxconn: $(sysctl -n net.core.somaxconn 2>/dev/null || echo 'N/A')"
echo "  fs.file-max: $(sysctl -n fs.file-max 2>/dev/null || echo 'N/A')"

# Create sysctl.d directory
echo -e "${YELLOW}[5/8] Creating sysctl configuration directory...${NC}"
if [[ "$DRY_RUN" == "false" ]]; then
    mkdir -p /etc/sysctl.d
fi

# Generate optimized sysctl configuration
echo -e "${YELLOW}[6/8] Creating container-optimized sysctl configuration...${NC}"

SYSCTL_CONTENT='# Container workload kernel parameter optimization
# Generated by container-sysctl-optimization script

# Memory management optimization for containers
vm.swappiness = 10
vm.dirty_ratio = 15
vm.dirty_background_ratio = 5
vm.vfs_cache_pressure = 50
vm.min_free_kbytes = 131072
vm.zone_reclaim_mode = 0
vm.max_map_count = 262144

# Memory overcommit settings
vm.overcommit_memory = 1
vm.overcommit_ratio = 80
vm.panic_on_oom = 0
vm.oom_kill_allocating_task = 1

# TCP optimization for container networking
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 5000
net.core.rmem_default = 262144
net.core.rmem_max = 16777216
net.core.wmem_default = 262144
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 65536 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

# TCP connection optimization
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_keepalive_intvl = 15

# Network namespace and routing optimization
net.ipv4.ip_forward = 1
net.ipv4.conf.all.forwarding = 1
net.ipv4.neigh.default.gc_thresh1 = 1024
net.ipv4.neigh.default.gc_thresh2 = 4096
net.ipv4.neigh.default.gc_thresh3 = 8192

# File system optimization
fs.file-max = 1000000
fs.nr_open = 1000000
fs.inotify.max_user_watches = 524288
fs.inotify.max_user_instances = 512

# Process and connection limits
kernel.pid_max = 4194304
kernel.threads-max = 4194304'

# Handle bridge netfilter parameters (may not be available on all systems)
BRIDGE_PARAMS='
# Bridge netfilter (only if bridge module is available)
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1'

if [[ "$DRY_RUN" == "false" ]]; then
    echo "$SYSCTL_CONTENT" > "$SYSCTL_CONFIG"
    
    # Try to load bridge module and add bridge parameters if successful
    if modprobe bridge 2>/dev/null; then
        echo "$BRIDGE_PARAMS" >> "$SYSCTL_CONFIG"
    fi
    
    chmod 644 "$SYSCTL_CONFIG"
    chown root:root "$SYSCTL_CONFIG"
    echo -e "${GREEN}Configuration written to: $SYSCTL_CONFIG${NC}"
else
    echo "Would create configuration file with optimized parameters"
fi

# Apply the configuration
echo -e "${YELLOW}[7/8] Applying sysctl configuration...${NC}"
if [[ "$DRY_RUN" == "false" ]]; then
    if sysctl --system; then
        echo -e "${GREEN}Sysctl configuration applied successfully${NC}"
    else
        echo -e "${YELLOW}Some parameters may not be available on this system${NC}"
    fi
else
    echo "Would apply sysctl configuration"
fi

# Verification
echo -e "${YELLOW}[8/8] Verifying configuration...${NC}"
if [[ "$DRY_RUN" == "false" ]]; then
    echo "Verifying key parameters:"
    echo "  vm.swappiness: $(sysctl -n vm.swappiness)"
    echo "  vm.max_map_count: $(sysctl -n vm.max_map_count)"
    echo "  net.core.somaxconn: $(sysctl -n net.core.somaxconn)"
    echo "  net.ipv4.tcp_fin_timeout: $(sysctl -n net.ipv4.tcp_fin_timeout)"
    echo "  fs.file-max: $(sysctl -n fs.file-max)"
    echo "  kernel.pid_max: $(sysctl -n kernel.pid_max)"
    
    # Check if configuration file exists and is readable
    if [[ -f "$SYSCTL_CONFIG" ]]; then
        echo -e "${GREEN}Configuration file created successfully${NC}"
    else
        echo -e "${RED}Configuration file was not created${NC}"
        exit 1
    fi
else
    echo "Would verify applied parameters"
fi

echo ""
echo -e "${GREEN}Container workload kernel optimization completed successfully!${NC}"
echo ""
echo "Summary:"
echo "- Optimized memory management parameters for containers"
echo "- Configured TCP settings for high-connection workloads"
echo "- Increased file descriptor and process limits"
echo "- Enabled IP forwarding for container networking"
echo ""
echo "The configuration will persist across reboots."
echo "Configuration file: $SYSCTL_CONFIG"
if [[ "$SKIP_BACKUP" == "false" && "$DRY_RUN" == "false" ]]; then
    echo "Backup location: $BACKUP_DIR"
fi