Mental model
Containers are NOT virtual machines. A container is a standard Linux process isolated by Namespaces (what the process can see) and bounded by Control Groups (cgroups v2) (how much resources the process can use).
Container Runtime Spawns Process
Assign Namespaces (pid, net, mnt, user)
Attach to cgroups v2 Unified Tree
Kernel enforces Memory/CPU limits
Process runs isolated on Host Kernel
Theory
- Linux Namespaces: Virtualize system resources.
pid: Process tree isolation (container process sees itself as PID 1).net: Isolated network devices, IP routing tables, and port bindings.mnt: Isolated file system mount points (chroot/pivot_root).user: Maps root user inside container (UID 0) to unprivileged UID on host.
- cgroups v2 (Unified Hierarchy): Controls CPU (
cpu.max), RAM (memory.max), Disk I/O (io.max), and PIDs (pids.max).
bash(12 lines)
1# Bash example: Restricting container memory & CPU using cgroups v2
2mkdir -p /sys/fs/cgroup/my_container
3
4# Set maximum memory to 512MB
5echo "536870912" > /sys/fs/cgroup/my_container/memory.max
6
7# Limit CPU to 2 cores (200,000 microseconds out of 100,000 quota period)
8echo "200000 100000" > /sys/fs/cgroup/my_container/cpu.max
9
10# Attach process PID 1234 to cgroup
11echo 1234 > /sys/fs/cgroup/my_container/cgroup.procs
Alternatives and trade-offs
- Virtual Machines (KVM / QEMU): Full guest OS hypervisor isolation; heavy RAM overhead and slow startup times.
- Linux Containers (cgroups v2 + Namespaces): Lightweight process isolation, native host speed, instant startup; shares the single host kernel.
Failure modes and misconceptions
- Host Memory Exhaustion via Uncapped Containers: Spawning containers without explicit
memory.maxlimits allows a single rogue container process to consume all host RAM, triggering global host OOM crashes. - Running Containers as Real Host Root: Running container processes without
usernamespace mapping means a container breakout grants full root access to the host host OS.
Reflect before revealing the guide
Decision scenario
Configure cgroups v2 memory.max and cpu.max controllers for production container deployments to prevent runaway processes from starving host resources.
Learning outcomes
- Explain how Linux Namespaces isolate PIDs, networks, and file mounts.
- Restrict container CPU, RAM, and PID allocations using
cgroups v2. - Secure host operating systems by enabling
usernamespace mapping.
Trade-offs
cgroups v2 and namespaces deliver near-zero overhead container virtualization, but share the single host kernel across all isolated process environments.