[diddly]

I thought my web site was under constant attack.  The PHP sub-process (fpm-php) was constantly pegged with multiple workers at 100% CPU, which is what this message forum uses.

I was wrong!  I was attacking myself with a poorly configured Nextcloud docker container.  Some background process I didn't know about was hammering the resources.

The fix for me was to add a redis cache (also as a docker container) and configure Nextcloud to use it.  These are the steps I followed:
1) Since we are already running Nextcloud as a docker container, it's safe to assume docker is installed and running
2) Create a docker container for redis.  I used something like the following command:

Code: [Select]

docker create \        --name=nextcloud-redis \
        --env=PUID=1000 \
        --env=PGID=1000 \
        --env=TZ=America/Toronto \
        -v /path/on/host/redis:/data \
        -p 6379:6379 \
        --restart=unless-stopped \
        redis
3) Start redis:

Code: [Select]

docker start nextcloud-redis && docker logs -f nextcloud-redis4) Reconfigure Nextcloud to use redis cache.  Edit your config.php for Nextcloud (mine sits in config/www/nextcloud/config/)
Add the following lines within the $CONFIG = array ( block:php

Code: [Select]

  'memcache.local' => '\OC\Memcache\APCu',
  'memcache.distributed' => '\OC\Memcache\Redis',
  'memcache.locking' => '\OC\Memcache\Redis',
  'redis' => [
    'host' => '192.168.x.x', // Matches the host IP running your redis container
    'port' => 6379,
  ],
5) Restart nextcloud

Code: [Select]

docker restart nextcloud && docker logs -f nextcloud
If all goes well, you should see the CPU usage for nextcloud drop like a rock in whatever monitoring tool you use.

(Update) In the time it took me to write this, whatever 15 minute background jobs is causing the blockage started again and once again my nextcloud container is taking 577% CPU.  Having a cache doesn't hurt, but the quest for a solution continues.
Also note, the above redis cache is unsecured and I'm relying on a well insulated LAN for protection.  You should probably add at least password protection to your cache.