CPU Isolation

CPU limits are enforced through a feature called CPU Isolation.

CPU Isolation is a setting that prevents Containers from using more than their allocated processing resources. When disabled, Containers can ‘steal’ additional processing resources on the underlying host, jeopardizing other Containers’ access to adequate resources, which could result in unexpected performance issues such as times outs, errors, and false alerting.

📘 CPU Isolation is enforced on all Shared Stacks by default, and Dedicated Stacks created after 2021. Aptible strongly recommends enabling CPU Isolation on existing Dedicated Stacks which do not currently have CPU Isolation enabled.

CPU Isolation is enabled on the Stack level and cannot be disabled once enabled.

CPU Isolation FAQ

Why should CPU Isolation be enabled on Dedicated Stacks?

Without CPU Isolation, there are a few important implications for Containers deployed on Dedicated Stacks:

• Containers will be allowed to use more CPU than their share.
• Containers may negatively impact other Containers on the Dedicated Stack if they use too much CPU.

In the absence of CPU Isolation, Containers are granted extra CPU that was not allocated to them, but their CPU share is not guaranteed. Conversely, if CPU Isolation are enabled, Containers are limited to their resource allocation, which is guaranteed.

What events can trigger in the absence of CPU Isolation?

Moreover, the underlying events that trigger these types of errors might not be visible at all:

• The Aptible platform may restart containers on different hosts at any time in response to a host machine failure or scheduled maintenance.
• Ephemeral SSH Sessions without CPU Isolation enabled may cause CPU starvation of Stack resources that are colocated with the bastion host instance—including the NAT Gateway, which will affect all outbound traffic.
• App host machines may be replaced with larger or smaller machines (typically, a seamless transition). If the excess CPU capacity an undersized Container was relying on suddenly disappears, it may induce a sudden, inexplicable drop in App performance!

CPU Isolation prevent these failure modes entirely.

What is the process to enable CPU Isolation?

Please contact Aptible Support to enable CPU Isolation. Since there is a risk that Apps without enforced CPU Limits are relying on resources beyond their nominal allocation, enabling CPU Limits on Dedicated Stacks is not trivial. Aptible Support will generate a report outlining which if any, services need to be scaled up before CPU Limits are enabled. Once users confirm that services that need additional resources have been adequately scaled up, the Support team will enable CPU Limits on the Dedicated Stack.

How long does it take to enable CPU Isolation?

Aptible Support can generate the report to identify if any services need to be scaled up within 24 hours. Once services are adequately scaled up, and confirmation is sent to Aptible Support, CPU Isolation can be enabled within 24 hours. There is no downtime involved in this process.

Can CPU Isolation be enabled on Shared Stacks?

CPU Isolation and Memory Limits are enforced on Shared Stacks by default. It is not possible to disable these limits on a Shared Stack.

Can CPU Isolation be disabled on Dedicated Stacks?

No, it is not possible to disable CPU Isolation after they are enabled. CPU Limits are enabled by default on all new Stacks as of 2021.

Why was CPU Isolation disabled in the past?

CPU Isolation was disabled in the past to provide surge capacity for individual services within a Dedicated Stack. Disabled CPU Isolation limits meant that excess CPU capacity on the host machine will not go unused if a container is taxed beyond its allocation. This allowed Containers that required increased resources for a short period to have access to as much processing power as was available on the host machine.