[自分用メモ][docker][container] docker composeでメモリ制限を行う方法

$ docker version
Client:
 Version:           18.09.5
 API version:       1.39
 Go version:        go1.10.8
 Git commit:        e8ff056
 Built:             Thu Apr 11 04:48:27 2019
 OS/Arch:           linux/arm64
 Experimental:      false
Server: Docker Engine - Community
 Engine:
  Version:          18.09.5
  API version:      1.39 (minimum version 1.12)
  Go version:       go1.10.8
  Git commit:       e8ff056
  Built:            Thu Apr 11 04:11:17 2019
  OS/Arch:          linux/arm64
  Experimental:     true

version: "2.4"
services:
  pdns_rec:
    image: kometchtech/pdnsrec:latest
    labels:
      private.kometch.job: "rec"
    ports:
      - 9953:53/udp
    volumes:
      - ${PWD}/powerdns:/etc/powerdns
    command: ["pdns_recursor", "--disable-syslog", "--log-timestamp=yes", "--daemon=no", "--write-pid=no"]
    restart: "always"
    mem_limit: 2g

$ docker-compose up -d pdnsrec
ERROR: The Compose file './docker-compose.yml' is invalid because:
Unsupported config option for services.pdns_rec: 'mem_limit'

$ docker-compose --help
Define and run multi-container applications with Docker.
Usage:
  docker-compose [-f <arg>...] [options] [COMMAND] [ARGS...]
  docker-compose -h|--help
Options:
  -f, --file FILE             Specify an alternate compose file
                              (default: docker-compose.yml)
  -p, --project-name NAME     Specify an alternate project name
                              (default: directory name)
  --verbose                   Show more output
  --log-level LEVEL           Set log level (DEBUG, INFO, WARNING, ERROR, CRITICAL)
  --no-ansi                   Do not print ANSI control characters
  -v, --version               Print version and exit
  -H, --host HOST             Daemon socket to connect to
  --tls                       Use TLS; implied by --tlsverify
  --tlscacert CA_PATH         Trust certs signed only by this CA
  --tlscert CLIENT_CERT_PATH  Path to TLS certificate file
  --tlskey TLS_KEY_PATH       Path to TLS key file
  --tlsverify                 Use TLS and verify the remote
  --skip-hostname-check       Don't check the daemon's hostname against the
                              name specified in the client certificate
  --project-directory PATH    Specify an alternate working directory
                              (default: the path of the Compose file)
  --compatibility             If set, Compose will attempt to convert keys
                              in v3 files to their non-Swarm equivalent

version: "3"
services:
  pdns_rec:
    image: kometchtech/pdnsrec:latest
    labels:
      private.kometch.job: "rec"
    ports:
      - 9953:53/udp
    volumes:
      - ${PWD}/powerdns:/etc/powerdns
    command: ["pdns_recursor", "--disable-syslog", "--log-timestamp=yes", "--daemon=no", "--write-pid=no"]
    restart: "always"
    deploy:
      resources:
        limits:
          memory: 2g

$ docker stats --no-stream docker-env_pdns_rec_1
CONTAINER ID        NAME                    CPU %               MEM USAGE / LIMIT   MEM %               NET I/O             BLOCK I/O           PIDS
36c4be8c2a31        docker-env_pdns_rec_1   0.19%               10.52MiB / 2GiB     0.51%               2.81MB / 3.91MB     94.2kB / 0B         7