Resource limits and isolation – Administrator Guide

StackRegent keeps subscriptions apart and stops one account from slowing down the whole server. It does this in two ways:

Resource limits: all processes of a subscription run in one Windows job object. These are its websites, PHP and scheduled tasks. The job object caps CPU, memory, disk I/O and the number of processes. This works like CloudLinux LVE.
Isolation: each subscription runs as its own Windows user, in its own IIS application pool, inside a webspace no other account can open. This works like CloudLinux CageFS.

Where limits come from#

A subscription gets its limits from the first of these that sets one:

Its own limits, saved on the subscription's Resource Usage page.
The Performance tab of its service plan (or of its customized settings), under Resource limits.
The server-wide Default limits. These apply only when the plan leaves a resource unlimited.

On the plan's Performance tab, the limit fields are:

Field	Unit	Note
CPU	% of one core	100 is one full core, 200 is two cores.
Memory	MB	Memory the processes may commit together. Above it, programs get out-of-memory errors; PHP shows HTTP 500.
Disk read and write speed	MB/s
Disk operations	per second
Processes	count	Above it, new PHP processes and tasks wait or fail. Allow at least 5.

Resource Usage (server view)#

Go to Tools & Settings › Resource Usage (under Assistance and Troubleshooting).

Enforcement: the Enforce resource limits switch. When it is off, the panel still measures usage but every subscription may use the whole server.
Default limits: values for CPU, memory, disk read and write, disk operations and processes. They are used for every subscription whose plan leaves that resource unlimited. Click Save defaults; they apply within a minute.
Subscriptions: the current use of each subscription against its limits. The Limit reached column counts the minutes in the last 24 hours in which a limit was hit. Click Details to open one subscription.

Values are averages of the last minute. The page refreshes every 15 seconds.

Resource Usage of one subscription#

Open it from the list above, or click Resource Usage on the subscription's page.

The cards show the current CPU, memory, disk I/O and processes, with the 24-hour average and peak.
Graphs cover 24 hours, 3 days or 30 days. Limits are drawn as a line.
Processes lists every process that runs as the subscription user, with CPU, memory and start time. Click End to stop one.
Limits: enter values and click Save limits. Leave a field empty for no limit. Saving here customizes the subscription, so later changes to its service plan no longer reach it.

If the page reports that some processes could not join the job, those processes run without limits. This happens, for example, when the process limit is reached, or when another program has already put them in a job.

Account Isolation#

Go to Tools & Settings › Account Isolation (under Assistance and Troubleshooting). Click Check all, or Check on one subscription. The status is Isolated, Check, Not isolated or Not checked. Click Details to see each test:

Test	Passes when
Own Windows user	The system user exists and has no administrative group memberships. A warning means the plan allows Remote Desktop.
Private webspace	Only the system user, SYSTEM and Administrators can open the webspace.
Own application pool	Every pool of the subscription runs as its system user.
Visitors run as the subscription	Anonymous requests run as the application pool user, not as a shared account.
Private PHP temp and sessions	PHP uploads, temporary files and sessions stay in the webspace's `tmp` folder.
Hidden neighbours	Subscriptions cannot list the folder that holds all webspaces.
Tested as the subscription user	Running as the system user, the check can open its own webspace and is refused another account's files.

If a subscription shows Check or Not isolated, click Repair. This queues a repair of the subscription. When the task is done, click Check again. The panel never follows junctions or hard links when it works on files.

Disk quotas#

Two settings control disk space:

Disk space on the plan's Resources tab is the subscription's limit. It is counted every night. What happens when it is exceeded depends on the Overuse policy.
Hard disk quota on the Hosting Parameters tab sets an NTFS disk quota for the subscription's system user, on the files it owns. Windows refuses writes above it. Unlimited means no quota.

To choose what counts towards a subscription's disk space, go to Tools & Settings › Server Settings, then Disk usage includes. The options are website files, logs, mail, databases, backups and anonymous FTP. To count again now, click Recalculate disk usage on the subscription's Statistics page.

IIS application pools#

Every subscription has its own application pool under its own Windows user. The pool settings are on the plan's Performance tab, under IIS application pool:

Dedicated application pool for each website. When this is off, all websites of the subscription share one pool.
Enable 32-bit applications and Load the user profile.
Maximum worker processes, Idle timeout and Idle timeout action.
Maximum CPU usage (% of all cores), CPU limit action and CPU limit interval. This CPU limit is used when the resource CPU limit is unlimited.
Recycling: Recycle at regular intervals, Recycle after this many requests, and recycling at virtual or private memory sizes.

To see and control the pools, go to Tools & Settings › IIS Application Pools (under Applications & Databases). The list shows each pool's state, .NET CLR version, websites and worker process IDs. Use Recycle, Stop or Start on a pool. Search by pool or website name.

Troubleshooting#

A site returns HTTP 500 under load: check its Resource Usage page. If memory or processes reach the limit, raise it for the subscription or in the plan.
A website is slow but the server is idle: the subscription may be at its CPU limit. The CPU graph shows the limit line.
Limits seem to have no effect: check that Enforce resource limits is on.