Linux Control Groups & Namespaces

Learning outcomes

• Restrict container CPU and memory budgets using cgroups v2
• Isolate process environments with Linux kernel namespaces

Mental model

Containers are NOT virtual machines. A container is a standard Linux process isolated by Namespaces (what the process can see) and bounded by Control Groups (cgroups v2) (how much resources the process can use).

Theory

• Linux Namespaces: Virtualize system resources.
  • pid: Process tree isolation (container process sees itself as PID 1).
  • net: Isolated network devices, IP routing tables, and port bindings.
  • mnt: Isolated file system mount points (chroot / pivot_root).
  • user: Maps root user inside container (UID 0) to unprivileged UID on host.
• cgroups v2 (Unified Hierarchy): Controls CPU (cpu.max), RAM (memory.max), Disk I/O (io.max), and PIDs (pids.max).

# Bash example: Restricting container memory & CPU using cgroups v2
mkdir -p /sys/fs/cgroup/my_container

# Set maximum memory to 512MB
echo "536870912" > /sys/fs/cgroup/my_container/memory.max

# Limit CPU to 2 cores (200,000 microseconds out of 100,000 quota period)
echo "200000 100000" > /sys/fs/cgroup/my_container/cpu.max

# Attach process PID 1234 to cgroup
echo 1234 > /sys/fs/cgroup/my_container/cgroup.procs

Alternatives and trade-offs

• Virtual Machines (KVM / QEMU): Full guest OS hypervisor isolation; heavy RAM overhead and slow startup times.
• Linux Containers (cgroups v2 + Namespaces): Lightweight process isolation, native host speed, instant startup; shares the single host kernel.

Failure modes and misconceptions

1. Host Memory Exhaustion via Uncapped Containers: Spawning containers without explicit memory.max limits allows a single rogue container process to consume all host RAM, triggering global host OOM crashes.
2. Running Containers as Real Host Root: Running container processes without user namespace mapping means a container breakout grants full root access to the host host OS.

Decision scenario

Configure cgroups v2 memory.max and cpu.max controllers for production container deployments to prevent runaway processes from starving host resources.

Learning outcomes

• Explain how Linux Namespaces isolate PIDs, networks, and file mounts.
• Restrict container CPU, RAM, and PID allocations using cgroups v2.
• Secure host operating systems by enabling user namespace mapping.

Trade-offs

cgroups v2 and namespaces deliver near-zero overhead container virtualization, but share the single host kernel across all isolated process environments.

Primary sources

• Linux Kernel Kernel.org Official Architecture & Systems Documentation — Linux Kernel Organization, verified 2026-07-23