In this lesson, you will learn how Control Groups (Cgroups) act as the "policeman" of the Linux kernel to enforce hardware resource limits on your containers.
Beyond Isolation
So far, we have discussed how Linux Namespaces provide isolation—ensuring that processes inside a container see their own private view of the system (like their own process list or network stack). However, isolation alone doesn't prevent a "greedy" process from consuming all the host’s RAM or CPU, which could crash the entire machine. This is where Control Groups (Cgroups) come in.
While Namespaces organize what a process can see, Cgroups govern how much of the host's physical resources a process is allowed to consume.
How Cgroups Work
Cgroups allow the kernel to group processes together and assign them resource budgets. Think of it like a shared office building: Namespaces ensure each tenant has their own private office, while Cgroups ensure one tenant doesn't use up all the building's electricity or water.
When you start a container with resource constraints, the Docker engine interacts with the Cgroups subsystem to set hard caps. For example, if you want to limit a container to a maximum of 512MB of RAM, the Cgroup associated with that container will trigger the kernel to intervene if the process tries to exceed that limit.
You can observe this behavior in a simplified way by looking at the interface exposed by the kernel:
# Example path where Cgroup memory limits are enforced
/sys/fs/cgroup/memory/docker/<container_id>/memory.limit_in_bytes
If a process hits this limit, the Cgroup can either throttle the process (to keep it running slowly) or trigger an "Out of Memory" (OOM) kill to protect the host's stability.
The Role of Governance
By managing CPU shares, memory limits, and I/O rates, Cgroups ensure that one heavy container does not create a "noisy neighbor" effect. In a production environment like Kubernetes, this governance is what allows us to run dozens of microservices on a single host with the confidence that each application will stay within its assigned resource quota.
Key Takeaway: While Namespaces provide the illusion of a private system, Cgroups provide the hard governance necessary to prevent containers from starving the host of critical hardware resources.