Last modified July 12, 2022

Kernel settings

We adjust some kernel settings of Flatcar Container Linux machines used as Kubernetes nodes to non-standard values. Here is a complete reference. For information on other Linux kernel settings, please refer to the official documentation.

General Performance and Security settings

SettingValueDescription
kernel.kptr_restrict2Hide kernel pointers to mitigate the kernels attack surface
kernel.sysrq0Reduce the kernel’s attack surface
net.ipv4.conf.all.arp_ignore1Harden SSH security
net.ipv4.conf.all.arp_announce2Harden SSH security
net.ipv4.conf.all.log_martians1Log all martians packets coming to existing network interfaces
net.ipv4.conf.all.rp_filter1Harden SSH security
net.ipv4.conf.all.send_redirects0Do not send redirects for IPv4
net.ipv4.conf.default.accept_redirects0Do not accept redirects for IPv4
net.ipv4.conf.default.log_martians1Log all martians packets coming to freshly added network interfaces
net.ipv4.tcp_timestamps0Do not add timestamps to use less CPU cycles
net.ipv6.conf.all.accept_redirects0Do not send redirects for IPv6
net.ipv6.conf.default.accept_redirects0Do not accept redirects for IPv6

Kubernetes specific tuning

SettingValueDescription
net.ipv4.ip_local_reserved_ports30000 - 32767Reserving for Node Ports allocations to avoid conflicts with kube-apiserver

Docker specific tuning

SettingValueDescription
fs.inotify.max_user_watches16384Increase the max number of opened file watches to avoid docker lock
fs.inotify.max_user_instances8192Increase the max number of file descriptors to avoid docker lock

Workload specific tuning

SettingValueDescription
net.core.somaxconn32768Ingress controller performance improvements
net.ipv4.ip_local_port_range1024 - 65535Ingress controller performance improvements
vm.max_map_count262144Increased max_map_count because some applications, like Elasticsearch, need higher limit to start properly

Unified cgroup hierarchy - cgroups v1 enforcement

SettingValueDescription
systemd.unified_cgroup_hierarchy0Switching to unified cgroups
systemd.legacy_systemd_cgroup_controllernullSwitching to unified cgroups