:_mod-docs-content-type: ASSEMBLY
:context: nodes-containers-using
[id="nodes-containers-sysctls"]
= Using sysctls in containers
include::_attributes/common-attributes.adoc[]

toc::[]

[role="_abstract"]
You can configure namespaced sysctls to manage kernel parameters for specific pods or network interfaces. By enabling safe or unsafe namespaced sysctls, you can fine-tune your environment's performance and networking behavior at the pod level.

Only sysctls that are namespaced can be set independently on pods. If a sysctl is not namespaced, it is known as a _node-level_ sysctl. You must use another method of setting the sysctl, such as by using the Node Tuning Operator. To set node-level sysctls, see "Using the Node Tuning Operator".

Network sysctls are a special category of sysctl. Network sysctls include:

* System-wide sysctls, for example `net.ipv4.ip_local_port_range`, that are valid for all networking. You can set these independently for each pod on a node.
* Interface-specific sysctls, for example `net.ipv4.conf.IFNAME.accept_local`, that only apply to a specific additional network interface for a given pod. You can set these independently for each additional network configuration. You set these by using a configuration in the `tuning-cni` after the network interfaces are created.

[IMPORTANT]
====
If the `net.ipv4.ip_local_port_range` safe sysctl parameter value and the default node port service range overlap, the OVN Kubernetes plugin might experience connection failures. For more information about this parameter, see the _System-wide safe sysctls_ table in the "Safe and unsafe sysctls" section.
====

Only those sysctls considered _safe_ are enabled by default. A cluster administrator can manually enable _unsafe_ sysctls on the node to be available to the user.

[role="_additional-resources"]
.Additional resources

* xref:../../networking/configuring_network_settings/configuring-node-port-service-range.adoc#configuring-node-port-service-range[Configuring the node port service range]

// The following include statements pull in the module files that comprise
// the assembly. Include any combination of concept, procedure, or reference
// modules required to cover the user story. You can also include other
// assemblies.

include::modules/nodes-containers-sysctls-about.adoc[leveloffset=+1]

include::modules/nodes-namespaced-nodelevel-sysctls.adoc[leveloffset=+1]

include::modules/nodes-safe-sysctls-list.adoc[leveloffset=+1]

[role="_additional-resources"]
== Additional resources

* xref:../../networking/ingress_load_balancing/configuring_ingress_cluster_traffic/configuring-ingress-cluster-traffic-nodeport.adoc#configuring-ingress-cluster-traffic-nodeport[Configuring ingress cluster traffic using a NodePort]

include::modules/update-network-sysctl-allowlist.adoc[leveloffset=+1]

include::modules/nodes-containers-start-pod-safe-sysctls.adoc[leveloffset=+1]

include::modules/nodes-containers-sysctls-setting.adoc[leveloffset=+1]

include::modules/nodes-containers-sysctls-unsafe.adoc[leveloffset=+1]

[role="_additional-resources"]
[id="additional-resources_nodes-containers-sysctls"]
== Additional resources

* link:https://docs.kernel.org/networking/ip-sysctl.html[Linux networking documentation]

* xref:../../networking/configuring_network_settings/configure-syscontrols-interface-tuning-cni.adoc#nw-configuring-tuning-cni_configure-syscontrols-interface-tuning-cni[Configuring system controls by using the tuning CNI]

* xref:../../scalability_and_performance/using-node-tuning-operator.adoc#using-node-tuning-operator[Using the Node Tuning Operator]

* link:https://www.kernel.org/doc/Documentation/sysctl/[Kernel.org documentation]
