Kernel parameters with sysctl

The /proc/sys tree: how the kernel exposes tunables. Every kernel parameter visible to sysctl lives as a file under /proc/sys. The directory hierarchy maps directly to the dot-separated name: net.ipv4.ip_forward lives at /proc/sys/net/ipv4/ip_forward. You can read and write files directly with cat and echo, but sysctl is the correct tool — it validates values and formats error messages.

# List all parameters and their current values (several thousand lines):
sysctl -a

# Filter to a subsystem:
sysctl -a | grep vm.

# Read one parameter:
sysctl vm.swappiness
# vm.swappiness = 60

# Read directly from /proc/sys (same value, less convenient):
cat /proc/sys/vm/swappiness
# 60

# Read the raw file for a network parameter:
cat /proc/sys/net/ipv4/ip_forward
# 0

Most parameters are integers. Some accept comma-separated lists (e.g. kernel.sched_domain.cpu0.domain0.flags). A value of 0 is typically “disabled”, 1 is “enabled” — but always read the man page for anything you change in production.

Runtime changes with sysctl -w. A runtime change takes effect immediately and survives until the next reboot. This is exactly what you want during incident response — you can tune, observe, and if the tuning made things worse, reboot to reset to the previous state.

# Enable IP forwarding (required for routing and containers):
sudo sysctl -w net.ipv4.ip_forward=1
# net.ipv4.ip_forward = 1

# Verify:
sysctl net.ipv4.ip_forward
# net.ipv4.ip_forward = 1

# Lower swappiness (kernel will prefer to keep more in RAM):
sudo sysctl -w vm.swappiness=10
# vm.swappiness = 10

# Raise the system-wide open file limit:
sudo sysctl -w fs.file-max=2097152
# fs.file-max = 2097152

# GOTCHA: this setting is lost on reboot
# After the next reboot:
sysctl vm.swappiness
# vm.swappiness = 60   ← back to default

The gotcha is the most common operational mistake. An engineer tuning a performance issue during an incident applies sysctl -w, the problem is resolved, the change is documented in a ticket — and then vanishes the next maintenance reboot. Persistence requires a separate step.

Persistent settings via /etc/sysctl.d. The sysctl configuration directories are read at boot by the kernel and at any time by sysctl --system. Drop a .conf file into /etc/sysctl.d/ — do not edit /etc/sysctl.conf directly (package upgrades can reset it).

# Create a project-specific tuning file:
sudo tee /etc/sysctl.d/99-myapp.conf << 'EOF'
# Allow the host to forward packets (needed for Docker, WireGuard, etc.)
net.ipv4.ip_forward = 1

# Low swappiness for a latency-sensitive service
vm.swappiness = 10

# System-wide open file limit for a high-connection service
fs.file-max = 2097152
EOF

# Apply ALL /etc/sysctl.d/*.conf files without rebooting:
sudo sysctl --system
# Applying /etc/sysctl.d/10-console-messages.conf ...
# Applying /etc/sysctl.d/99-myapp.conf ...
# net.ipv4.ip_forward = 1
# vm.swappiness = 10
# fs.file-max = 2097152

# Verify one specific parameter is now persistent:
cat /etc/sysctl.d/99-myapp.conf | grep ip_forward
# net.ipv4.ip_forward = 1

Files are processed in lexicographic order. 99- prefix ensures your file wins over distribution defaults (which use prefixes like 10- or 60-). A parameter set in a later file always overrides one set in an earlier file.

Three parameters every fullstack engineer should know.

# 1. vm.swappiness (default: 60)
# Controls how aggressively the kernel swaps pages to disk.
# 0 = swap only when the system is completely out of RAM
# 60 = default, suitable for desktops
# 10 = latency-sensitive servers (database hosts, app servers)
# 100 = swap as aggressively as possible (rarely useful)
sysctl vm.swappiness

# 2. net.ipv4.ip_forward (default: 0)
# When set to 0, the kernel DROPS packets addressed to another host.
# This breaks: Docker bridge networking, WireGuard VPN, any NAT setup.
# Without ip_forward=1, a container on a different subnet cannot reach the internet.
# Docker sets this on startup — but it reverts to 0 on reboot without sysctl.d.
sysctl net.ipv4.ip_forward

# 3. fs.file-max (default: varies, often ~100000)
# The system-wide limit on open file descriptors (all processes combined).
# Each network socket, open file, and pipe costs one file descriptor.
# A busy web server or database easily hits this at tens of thousands of connections.
# Note: per-process limit is controlled separately by ulimit / /etc/security/limits.conf
sysctl fs.file-max

# See all current values that differ from kernel defaults (useful for auditing):
sysctl -a 2>/dev/null | grep -v "^#"

The ip_forward parameter is the one most likely to bite you in a container or VPN context: containers start, but have no internet connectivity, because the host was rebooted without the persistent sysctl, Docker’s own startup re-enables it at runtime, but your custom routing rules reference an interface that wasn’t up yet. Always persist ip_forward in sysctl.d.

Loading and verifying the full configuration. After any change to /etc/sysctl.d/, use sysctl --system to apply without rebooting. After a reboot, the same files are applied automatically by systemd-sysctl.service.

# See which files sysctl --system will process and in what order:
ls -la /etc/sysctl.d/ /usr/lib/sysctl.d/ /run/sysctl.d/ 2>/dev/null

# Apply all files and see what changed:
sudo sysctl --system

# Confirm a specific value was applied from your file:
sysctl net.ipv4.ip_forward
# net.ipv4.ip_forward = 1

# Check the systemd unit that applies sysctl on boot:
systemctl status systemd-sysctl.service
# Loaded: loaded (/lib/systemd/system/systemd-sysctl.service; static)
# Active: inactive (dead)
# (inactive is correct — it runs once at boot and exits)

# If you want to apply only your new file (not all files):
sudo sysctl -p /etc/sysctl.d/99-myapp.conf
# net.ipv4.ip_forward = 1
# vm.swappiness = 10
# fs.file-max = 2097152