Control Groups

Suppose a Linux server has 32 CPUs and 64 GiB of memory, but one API service should use no more than two CPUs' worth of processing time and 4 GiB of memory.

Namespaces cannot enforce these limits. A PID namespace controls which processes the service can see, while a mount namespace controls which files it can see.

Linux uses control groups, or cgroups, to manage resource usage.

A cgroup groups processes together and lets the kernel track and control resources such as CPU, memory, I/O, and process counts.

Namespaces control what processes can see. Cgroups control how resources are accounted for and limited.

Cgroups are not limited to containers. They are also used for system services, user sessions, virtual machines, and other workloads that need resource boundaries.

This chapter develops the cgroup v2 hierarchy and controller model, then explains CPU weights and quotas, memory, I/O, PID, and placement controls, policy types, systemd integration, inspection, and experimentation.