Proxmox LXC out of memory tmpfs journald: fix the OOM kill

Proxmox LXC out of memory tmpfs journald — that’s the combo that kills small containers. journald writes logs to /run/log/journal, which is tmpfs, and tmpfs counts against the container’s memory limit. Defaults let it use up to 10% of RAM, and on a 512MB container that’s 51MB gone before your app even starts.

Why journald eats your container’s memory

Inside an unprivileged LXC, /run is a tmpfs mount. journald puts its logs there by default. The problem: tmpfs usage counts toward the container’s memory cgroup limit. So when journald writes a lot, the kernel sees the container using more memory, and the OOM killer strikes.

It’s not that journald is leaking. It’s that the default settings assume a full system with gigabytes of RAM. In a tiny container, 10% is a lot. And if the container is doing anything that generates logs — cron jobs, sshd, whatever — it fills up fast.

The fix: cap journald in journald.conf

Edit /etc/systemd/journald.conf inside the container. Add or change these lines:

[Journal]
RuntimeMaxUse=16M
SystemMaxUse=16M
RuntimeMaxFileSize=4M
SystemMaxFileSize=4M

Then restart journald:

systemctl restart systemd-journald

RuntimeMaxUse caps how much journald can keep in /run (tmpfs). SystemMaxUse caps the persistent logs in /var/log/journal. 16M is plenty for a small container. If you need more, bump it up, but keep it under 20% of the container’s RAM.

You can also set RuntimeMaxUse=0 to make journald not use tmpfs at all, but then logs go to /var/log/journal which might be on the container’s disk. That’s fine if you have the space.

Check if it’s actually journald

Before you change anything, confirm the OOM is from tmpfs. Inside the container, run:

df -h /run

If /run is tmpfs and nearly full, that’s your culprit. Also check journald’s current usage:

journalctl --disk-usage

If it’s close to your container’s memory limit, you found it.

My take

This is a stupid default for containers. systemd should detect a small memory cgroup and scale down automatically, but it doesn’t. So you have to set it manually. Do this on every small LXC you run. It’s one config file and a restart, and it stops the random OOM kills.

If you’re running a lot of containers, check out LXC Jellyfin start and jellyfin service stop after a few moment: fix the container config for more container tweaks.