{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/interpret-docker-memory-swap-together-with-the-memory-limit/", "item": { "id": "https://update.dsesecurity.com/updates/interpret-docker-memory-swap-together-with-the-memory-limit/", "slug": "interpret-docker-memory-swap-together-with-the-memory-limit", "url": "https://update.dsesecurity.com/updates/interpret-docker-memory-swap-together-with-the-memory-limit/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/interpret-docker-memory-swap-together-with-the-memory-limit.md", "json": "https://update.dsesecurity.com/api/v1/posts/interpret-docker-memory-swap-together-with-the-memory-limit/" }, "title": "Interpret Docker memory-swap together with the memory limit", "summary": "The swap setting is not simply a second independent RAM allowance.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:15:11+00:00", "modified_at": "2026-10-20T18:34:32+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 265, "potentially_affected": "Review Docker memory/swap settings as a pair and compare them with the host's available swap.", "dse_recommendation": "DSE recommends recording the intended RAM boundary and permitted swap behavior as a pair.", "primary_source": { "name": "Docker documentation — Resource constraints", "url": "https://docs.docker.com/engine/containers/resource_constraints/", "published_on": null, "authority": "docs.docker.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

The swap setting is not simply a second independent RAM allowance.

\n

Source facts

\n

Docker documents --memory-swap as a combined memory-and-swap allowance when used with --memory. Setting both to the same positive value prevents container swap use. A value of -1 permits swap up to what the host provides. Docker also warns that tools such as free inside a container report host swap rather than the container’s actual permitted swap.

\n

Source: Docker documentation — Resource constraints.

\n

Applicability

\n

Review Docker memory/swap settings as a pair and compare them with the host’s available swap.

\n

DSE recommendation

\n

DSE recommends recording the intended RAM boundary and permitted swap behavior as a pair. Consider latency sensitivity as well as survival under memory pressure; a workload that keeps running while swapping may still fail its service objective. Keep host capacity and other containers in the review. Do not infer enforcement from a familiar command’s output inside the container. Preserve OOM and pressure evidence before increasing limits so a larger allowance does not hide an application growth problem or shift the failure to the host.

\n

Verification

\n

On an isolated host with representative test load, inspect the effective container configuration and relevant host accounting. Confirm that the chosen settings produce the intended swap boundary. Observe latency, memory pressure, and termination evidence together, then document the measured basis for the production values. Retain the two configured values and the host observation with the trial’s load profile. Have the application owner approve the observed response time as well as survival under pressure before changing a production allowance.

\n

Official reference

\n

Docker documentation — Resource constraints. Reviewed October 20, 2026.

", "content_text": "The swap setting is not simply a second independent RAM allowance.\nSource facts\nDocker documents --memory-swap as a combined memory-and-swap allowance when used with --memory. Setting both to the same positive value prevents container swap use. A value of -1 permits swap up to what the host provides. Docker also warns that tools such as free inside a container report host swap rather than the container’s actual permitted swap.\nSource: Docker documentation — Resource constraints.\nApplicability\nReview Docker memory/swap settings as a pair and compare them with the host’s available swap.\nDSE recommendation\nDSE recommends recording the intended RAM boundary and permitted swap behavior as a pair. Consider latency sensitivity as well as survival under memory pressure; a workload that keeps running while swapping may still fail its service objective. Keep host capacity and other containers in the review. Do not infer enforcement from a familiar command’s output inside the container. Preserve OOM and pressure evidence before increasing limits so a larger allowance does not hide an application growth problem or shift the failure to the host.\nVerification\nOn an isolated host with representative test load, inspect the effective container configuration and relevant host accounting. Confirm that the chosen settings produce the intended swap boundary. Observe latency, memory pressure, and termination evidence together, then document the measured basis for the production values. Retain the two configured values and the host observation with the trial’s load profile. Have the application owner approve the observed response time as well as survival under pressure before changing a production allowance.\nOfficial reference\nDocker documentation — Resource constraints. Reviewed October 20, 2026.", "content_markdown": "The swap setting is not simply a second independent RAM allowance.\n\n## Source facts\n\nDocker documents --memory-swap as a combined memory-and-swap allowance when used with --memory. Setting both to the same positive value prevents container swap use. A value of -1 permits swap up to what the host provides. Docker also warns that tools such as free inside a container report host swap rather than the container’s actual permitted swap.\n\nSource: [Docker documentation — Resource constraints](https://docs.docker.com/engine/containers/resource_constraints/).\n\n## Applicability\n\nReview Docker memory/swap settings as a pair and compare them with the host’s available swap.\n\n## DSE recommendation\n\nDSE recommends recording the intended RAM boundary and permitted swap behavior as a pair. Consider latency sensitivity as well as survival under memory pressure; a workload that keeps running while swapping may still fail its service objective. Keep host capacity and other containers in the review. Do not infer enforcement from a familiar command’s output inside the container. Preserve OOM and pressure evidence before increasing limits so a larger allowance does not hide an application growth problem or shift the failure to the host.\n\n## Verification\n\nOn an isolated host with representative test load, inspect the effective container configuration and relevant host accounting. Confirm that the chosen settings produce the intended swap boundary. Observe latency, memory pressure, and termination evidence together, then document the measured basis for the production values. Retain the two configured values and the host observation with the trial’s load profile. Have the application owner approve the observed response time as well as survival under pressure before changing a production allowance.\n\n## Official reference\n\n[Docker documentation — Resource constraints](https://docs.docker.com/engine/containers/resource_constraints/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/interpret-docker-memory-swap-together-with-the-memory-limit/", "url": "https://update.dsesecurity.com/updates/interpret-docker-memory-swap-together-with-the-memory-limit/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/interpret-docker-memory-swap-together-with-the-memory-limit/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "IT", "item": "https://update.dsesecurity.com/topic/it/" }, { "@type": "ListItem", "position": 3, "name": "Interpret Docker memory-swap together with the memory limit", "item": "https://update.dsesecurity.com/updates/interpret-docker-memory-swap-together-with-the-memory-limit/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/interpret-docker-memory-swap-together-with-the-memory-limit/#article", "identifier": "https://update.dsesecurity.com/updates/interpret-docker-memory-swap-together-with-the-memory-limit/", "url": "https://update.dsesecurity.com/updates/interpret-docker-memory-swap-together-with-the-memory-limit/", "headline": "Interpret Docker memory-swap together with the memory limit", "description": "The swap setting is not simply a second independent RAM allowance.", "abstract": "The swap setting is not simply a second independent RAM allowance.", "articleBody": "The swap setting is not simply a second independent RAM allowance.\nSource facts\nDocker documents --memory-swap as a combined memory-and-swap allowance when used with --memory. Setting both to the same positive value prevents container swap use. A value of -1 permits swap up to what the host provides. Docker also warns that tools such as free inside a container report host swap rather than the container’s actual permitted swap.\nSource: Docker documentation — Resource constraints.\nApplicability\nReview Docker memory/swap settings as a pair and compare them with the host’s available swap.\nDSE recommendation\nDSE recommends recording the intended RAM boundary and permitted swap behavior as a pair. Consider latency sensitivity as well as survival under memory pressure; a workload that keeps running while swapping may still fail its service objective. Keep host capacity and other containers in the review. Do not infer enforcement from a familiar command’s output inside the container. Preserve OOM and pressure evidence before increasing limits so a larger allowance does not hide an application growth problem or shift the failure to the host.\nVerification\nOn an isolated host with representative test load, inspect the effective container configuration and relevant host accounting. Confirm that the chosen settings produce the intended swap boundary. Observe latency, memory pressure, and termination evidence together, then document the measured basis for the production values. Retain the two configured values and the host observation with the trial’s load profile. Have the application owner approve the observed response time as well as survival under pressure before changing a production allowance.\nOfficial reference\nDocker documentation — Resource constraints. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:15:11+00:00", "dateModified": "2026-10-20T18:34:32+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/interpret-docker-memory-swap-together-with-the-memory-limit/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/interpret-docker-memory-swap-together-with-the-memory-limit/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Interpret Docker memory-swap together with the memory limit" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 265, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Docker documentation — Resource constraints", "url": "https://docs.docker.com/engine/containers/resource_constraints/" } } ] } }