Kubernetes (through cAdvisor) exposes several memory metrics: working set, cache, mapped files, etc. The table below contains an incomplete list of actions that affect some of those metrics.

Action RSS Cache Mapped File Working Set Usage
Stack and heap ✅ ❌ ❌ ✅ ✅
File read (uncached) ❌ ✅ ❌ ❌ ✅
File read (cached) ❌ ❌ ❌ ❌ ❌
File create+write ❌ ✅ ❌ ❌ ✅
File create+write (tmpfs) ❌ ✅ ❌ ✅ ✅
File mmap(2) (uncached) ❌ ✅ ✅ ✅ ✅
File mmap(2) (cached) ❌ ❌ ❌ ❌ ❌

Some explanations on the actions:

  • Stack and heap refers the stack memory where local variables are stored and the memory obtained from malloc(3) (or related function calls) respectively.

  • File read refers to opening and reading files with fopen(3) and fgetc(3) family of functions.

    “Cached” means that the file that is being read is already present in the page cache / file system cache. This can be checked with the vmtouch command, and a fully-cached file looks like this:

    $ vmtouch /usr/bin/wireshark
            Files: 1
      Directories: 0
    Resident Pages: 2584/2584  10M/10M  100%
          Elapsed: 2.5e-05 seconds

    While an uncached file looks like this:

    $ vmtouch ~/Downloads/google-cloud-cli-linux-x86_64.tar.gz
          Files: 1
    Directories: 0
  Resident Pages: 0/32369  0/126M  0%
        Elapsed: 0.000406 seconds

    Evicting a file from page cache can be done with vmtouch -e.

    Note: A file located in a tmpfs filesystem (e.g. /tmp on Ubuntu 24.04) will always be present in the page cache and cannot be evicted

  • File create+write refers to creating a file and writing data into it with fopen(3) and fwrite(3) family of functions. tmpfs refers to whether the file was created in a tmpfs filesystem (e.g. /tmp) or not.

  • File mmap(2) refers to memory-mapping a file with mmap(2) and reading all of its contents via the returned pointer. “Cached” also refers to the kernel’s page cache.