NoMachine and slurm created cgroups

[jeremy.fix]

Hello everyone,

We installed NoMachine on clusters we use remotely. These clusters are handled with a scheduler called slurm. Every time a user allocate a node with slurm, its session enters a cgroup which bounds the resources the user can use. Slurm allows for example one user to use a specific number of cores, memory ,etc..

For now, unfortunately, I do not know how to tell NoMachine that it should start its processes within that cgroup that has been created for the user.

Currently, the unsatisfactory implementation we have is that we allow the user to open a NoMachine session with a

/usr/NX/bin/nxserver —userenable $SLURM_JOB_USER

as soon as it requested a session. Then the user can start the NoMachine graphical session. But, within the NoMachine session, the user can bypass the cgroup restriction that have been allocated to that user which is unfortunate.

Do you know if there is any mechanism through we could say that any processes run within the NoMachine graphical session must be placed within the cgroup of the user ?

Thank you for your help;

Jeremy.

[Britgirl]

This sounds more of a consultancy project and a bit out of scope of the tips and assistance that these forums can provide. It might be worth getting in touch with our support team if you have not done so already. We can keep this topic open a bit longer in case other users have have some tips they’re willing to share 🙂

[jeremy.fix]

Thank you for your answer; There is indeed an ongoing discussion with the NoMachine support team ; If we succeed to make any progress (and this is for now on my side to provide more inputs) , I will drop a message in there.

[jeremy.fix]

For those of you interested in a solution, we worked with the support on a solution to this problem which can be tested in the vagrant testbed: https://github.com/jeremyfix/devops_samples/tree/main/nomachine

Thank you for your help;

Jeremy.

[Britgirl]

Thanks for updating the topic with your solution.

[Author]

Posts