Control Groups
The Linux kernel feature that caps and accounts for a process group's CPU, memory, and I/O — the resource-limiting half of a container.
Control groups (cgroups) are a Linux kernel feature that groups processes together and applies resource limits — CPU shares, memory ceilings, I/O bandwidth, process counts — to the group as a whole. Where Linux Namespaces control what a process can see, cgroups control what it can use; together they are the two kernel primitives that containers are built from, and neither one alone is a container.
A memory cgroup with a hard limit will have the kernel's out-of-memory killer target processes inside it specifically when they exceed the cap, rather than letting one runaway process starve the whole machine. A CPU cgroup can cap a group to a fraction of a core even on an otherwise idle system, which is how a container's "2 CPUs" setting is actually enforced rather than merely advertised.
Cgroups v2, the current unified hierarchy, replaced an earlier v1 design where each resource controller (cpu, memory, blkio) mounted its own independent tree, so a process could sit at a different position in the CPU hierarchy than in the memory one. v2 puts every controller on one tree, which is simpler to reason about and is what modern Systemd and container runtimes assume.
The everyday symptom of a cgroup limit is a process that gets killed with no error message and no stack trace — just gone, restarted, gone again. dmesg or the kernel log showing an OOM-kill event against the process's cgroup is usually the first real clue, since the process's own logs never get the chance to record why.
See also7
Containerization
Packaging an application with its dependencies into an isolated, reproducible runtime unit.
Systems & Tooling33 connections
Systemd
The dominant Linux init system, replacing sequential startup scripts with declarative, parallel, dependency-aware units.
Systems & Tooling16 connections
Process
A running program with its own memory, environment, and identity.
Systems & Tooling33 connections
CPU Affinity
Restricting which cores a thread may run on, which matters most on processors whose cores are not all alike.
Systems & Tooling11 connections
Pressure Stall Information
A kernel metric for how much time work spent waiting on CPU, memory, or I/O, which measures contention directly where utilization figures only hint at it.
Systems & Tooling13 connections
Kubernetes
A system that runs containers across a cluster of machines by continually reconciling what is running with a declared desired state, powerful and notoriously complex.
Systems & Tooling10 connections
Device File
Special files that represent hardware and kernel services, letting programs read a disk, a mouse, or a stream of random bytes with the same calls they use on ordinary files.
Systems & Tooling13 connections
Linked from14
- Agent SandboxAgents & Language Models
Confining an agent's commands to a limited environment, so that a mistaken or hijacked action can only damage what the sandbox allows it to reach.
- ChrootSystems & Tooling
Rebasing a process's idea of the filesystem root, the oldest and shallowest form of Unix process isolation.
- CPU AffinitySystems & Tooling
Restricting which cores a thread may run on, which matters most on processors whose cores are not all alike.
- CPU SchedulerSystems & Tooling
The part of the kernel that decides which runnable thread gets each CPU core next, and for how long, trading throughput against latency.
- Device FileSystems & Tooling
Special files that represent hardware and kernel services, letting programs read a disk, a mouse, or a stream of random bytes with the same calls they use on ordinary files.
- HypervisorSystems & Tooling
The layer that lets multiple guest operating systems share one machine's hardware, each believing it owns the machine.
- KernelSystems & Tooling
The core of an operating system that runs with full hardware privileges, managing processes, memory, devices, and files on behalf of every other program.
- KubernetesSystems & Tooling
A system that runs containers across a cluster of machines by continually reconciling what is running with a declared desired state, powerful and notoriously complex.
- Linux NamespacesSystems & Tooling
The kernel feature that gives a process its own private view of a global resource — the foundation containers are built from.
- Out-of-Memory KillerSystems & Tooling
The kernel's last resort when memory is exhausted, killing a process chosen by heuristic, and the userspace daemons that act earlier with better judgment.
- Pressure Stall InformationSystems & Tooling
A kernel metric for how much time work spent waiting on CPU, memory, or I/O, which measures contention directly where utilization figures only hint at it.
- SwapSystems & Tooling
Somewhere to put memory pages that are not being used, so RAM can go to pages that are, whether that place is a disk or a compressed region of RAM itself.
- System CallSystems & Tooling
The doorway through which a program asks the operating system kernel to do anything privileged, from reading a file to starting a process.
- SystemdSystems & Tooling
The dominant Linux init system, replacing sequential startup scripts with declarative, parallel, dependency-aware units.