kernel

Settings related to the Linux kernel (settings.kernel.*)

Topic list

Setting list for settings.kernel

Topics

Huge pages

Huge pages let the kernel manage memory in larger blocks than the default page size, reducing translation lookaside buffer (TLB) pressure for memory-intensive workloads. Bottlerocket exposes two independent families under settings.kernel.hugepages: static reserves a fixed pool of HugeTLB pages at boot, while transparent tunes the kernel’s Transparent Huge Pages (THP) behavior at runtime. Static reservations are applied once during early boot and require a reboot to change.
[settings.kernel.hugepages.static]
essential = true
"2Mi" = { count = "512" }
"1Gi" = { count = "4" }

[settings.kernel.hugepages.transparent]
enabled = "always"
defrag = "defer+madvise"

apiclient set \
  settings.kernel.hugepages.static.essential=true \
  settings.kernel.hugepages.static.2Mi.count="512" \
  settings.kernel.hugepages.static.1Gi.count="4" \
  settings.kernel.hugepages.transparent.enabled="always" \
  settings.kernel.hugepages.transparent.defrag="defer+madvise"

Settings

Full Reference

settings.kernel.hugepages.static.<size>.count

Reserves a pool of huge pages of the given <size> at boot time. <size> is the huge page size and count is the number of pages to reserve. Changes to this setting only take effect on boot.

# Reserve 512 pages of 2 MiB (1 GiB total) across all NUMA nodes.
[settings.kernel.hugepages.static]
"2Mi" = { count = "512" }

# Reserve 1 GiB pages per NUMA node: 2 pages on node 0 and 2 pages on node 1.
[settings.kernel.hugepages.static]
"1Gi" = { count = "0:2,1:2" }

apiclient apply <<EOF
[settings.kernel.hugepages.static."2Mi"]
count="512"
EOF

apiclient apply <<EOF
[settings.kernel.hugepages.static."1Gi"]
count = "0:2,1:2"
EOF
Also see: 

settings.kernel.hugepages.static.essential

Controls whether a shortfall in the requested static huge page reservation is fatal at boot.

Default: false

Accepted values:
  • true
  • false
# Require the full reservation; fail to boot otherwise.
[settings.kernel.hugepages.static]
essential = true
"1Gi" = { count = "4" }

apiclient apply <<EOF
[settings.kernel.hugepages.static]
essential = true
"1Gi" = { count = "4" }
EOF
Also see: 

settings.kernel.hugepages.transparent.defrag

Controls how much effort the kernel spends defragmenting memory to satisfy a transparent huge page allocation.

Default: derived from hugepages.transparent.enabled, which defaults to madvise

Accepted values:
  • always : stall the allocating task until huge pages are available.
  • defer : wake the background reclaim/compaction daemons and fall back to smaller pages for now.
  • defer+madvise : behave like defer, but stall for regions that used madvise(MADV_HUGEPAGE).
  • madvise : stall only for regions that used madvise(MADV_HUGEPAGE).
  • never : do not defragment for transparent huge pages.
[settings.kernel.hugepages.transparent]
enabled = "always"
defrag = "defer+madvise"

apiclient set settings.kernel.hugepages.transparent.enabled="always"
apiclient set settings.kernel.hugepages.transparent.defrag="defer+madvise"
Also see: 

settings.kernel.hugepages.transparent.enabled

Sets the Transparent Huge Pages (THP) policy, which controls when the kernel automatically backs memory with huge pages.

Default: madvise

Accepted values:
  • always : the kernel tries to use transparent huge pages for all eligible memory.
  • madvise : the kernel uses transparent huge pages only for memory regions that request them via madvise(MADV_HUGEPAGE).
  • never : disables transparent huge pages.
[settings.kernel.hugepages.transparent]
enabled = "always"

apiclient set settings.kernel.hugepages.transparent.enabled="always"
Also see: 

settings.kernel.lockdown

Sets the mode for the lockdown Linux security module.

Default: integrity except for nvidia and dev variant flavours which use none

Accepted values:
  • confidentiality : blocks most methods of reading kernel memory from userspace. Tools that rely on reading kernel memory may not work in this mode.
  • integrity : blocks most methods for overwriting kernel memory or modifying kernel code. This mode prevents unsigned kernel modules from loading.
  • none : disables protection by the Lockdown security module.
Also see: 

settings.kernel.modules.<name>.allowed

Allows (true) or disallows (false) the loading of kernel module <name>.

Accepted values:
  • true
  • false
[settings.kernel.modules.sctp]
allowed = false

[settings.kernel.modules.udf]
allowed = true

apiclient set settings.kernel.modules.sctp.allowed=false

apiclient set settings.kernel.modules.udf.allowed=true
Also see: 

settings.kernel.modules.<name>.autoload

If true, the kernel <name> module loads automatically on boot.

Accepted values:
  • true
  • false
[settings.kernel.modules.ip_vs_lc]
allowed = true
autoload = true

apiclient set settings.kernel.modules.ip_vs_lc.allowed=true settings.kernel.modules.ip_vs_lc.autoload=true
Also see: 

settings.kernel.sysctl

Sets kernel parameters.

[settings.kernel.sysctl]
"user.max_user_namespaces" = "16384"
"vm.max_map_count" = "262144"
Also see: