Best practices for using Perf with ACS-Container Compute Service(ACS)-阿里云帮助中心

The perf tool lets you analyze performance issues in Container Compute Service (ACS) workloads — from memory leaks and CPU hot spots to lock contention and cache performance.

Use cases

Use the perf tool when you need answers to questions like these:

Why is application memory growing continuously? Track memory allocation hot spots to locate the source of the leak.
Why is CPU utilization abnormally high? Identify the functions or code paths consuming the most CPU.
Why is a multi-threaded application slow? Analyze lock contention to find performance bottlenecks.
Why is a latency-sensitive application underperforming? Analyze the CPU cache hit ratio to optimize data access patterns.

Applicability

Using the perf tool in ACS requires specific security permissions. Submit a ticket to request them before proceeding.

Set up perf in ACS

Step 1: Create an example pod

Create a pod with the following configuration. The security context settings grant the minimum capabilities required by the perf tool — using PERFMON instead of SYS_ADMIN follows the principle of least privilege.

apiVersion: v1
kind: Pod
metadata:
  labels:
    alibabacloud.com/compute-class: gpu # Modify as needed.
    alibabacloud.com/compute-qos: default
    alibabacloud.com/gpu-model-series: G59 # Modify as needed.
  name: perf-test
spec:
  containers:
  - command:
    - sh
    - -c
    - sleep infinity
    image: acs-registry-vpc.cn-wulanchabu.cr.aliyuncs.com/egslingjun/inference-nv-pytorch:25.12-vllm0.12.0-pytorch2.9-cu128-20251215-serverless # Modify as needed.
    name: main
    resources:
      limits:
        cpu: "4"
        memory: 8Gi
        nvidia.com/gpu: "1"
      requests:
        cpu: "4"
        memory: 8Gi
        nvidia.com/gpu: "1"
    securityContext:
      capabilities:
        add:
        - SYS_PTRACE
        - PERFMON
      privileged: false
  securityContext:
    sysctls:
    - name: kernel.perf_event_paranoid
      value: "-1"
    - name: kernel.kptr_restrict
      value: "0"

The following table describes the key security configuration items:

Configuration item	Description
`kernel.perf_event_paranoid: "-1"`	Allows non-root users to access perf events.
`kernel.kptr_restrict: "0"`	Allows reading kernel symbol addresses for parsing the call stack.
`SYS_PTRACE`	Grants process tracing capabilities.
`PERFMON`	Grants performance monitoring capabilities. Use `PERFMON` instead of `SYS_ADMIN` — it provides more granular control and follows the principle of least privilege.

Step 2: Install the perf tool

Access the container through a terminal and install perf:
```
apt update && apt install linux-tools-generic -y
```

Create a symbolic link for version compatibility:

GENERIC_DIR=$(find /usr/lib/linux-tools/ -name "*-generic" | head -n 1)
ln -s $GENERIC_DIR /usr/lib/linux-tools/$(uname -r)

Verify the installation:
```
perf --version
```
Expected output:
```
perf version 6.8.12
```
The actual version number may differ depending on your environment.