In this lesson, you will learn how to empower unprivileged users to manage their own resource sub-trees, enabling self-contained orchestration without requiring root access.
The Problem with Root-Only Control
Typically, resource management in cgroup v2 is a root-privileged operation. When you interact with files under /sys/fs/cgroup/, you are operating as the system administrator. In a multi-tenant environment—or a sophisticated container runtime—you don’t want your application process to require full root privileges just to limit its own child processes' memory or CPU usage. This is where delegation comes in.
Understanding Delegation
Delegation is the process of transferring ownership of a specific cgroup sub-tree to a non-root user. By changing the ownership (chown) of a cgroup directory to a specific user, the kernel permits that user to create, modify, and monitor nested cgroups within that branch.
Once delegated, the user can act as an "orchestrator" for their own sub-processes. They can create new directories (new cgroups) and write to controllers like memory.max or cpu.max within their assigned scope.
A Practical Example
If you are logged in as user1000 and an administrator has delegated a directory to you, your workflow would look like this:
# Administrator delegates a slice of resources
chown -R user1000:user1000 /sys/fs/cgroup/user.slice/user-1000.slice
# Now, as user1000, you can create your own sub-groups
mkdir /sys/fs/cgroup/user.slice/user-1000.slice/my_app_container
# You can now configure limits for this child process without root
echo "512M" > /sys/fs/cgroup/user.slice/user-1000.slice/my_app_container/memory.max
The system ensures that even though you have control over your own sub-tree, you cannot exceed the limits imposed on the parent cgroup. This creates a secure sandbox where you can manage your internal resource consumption (CPU, memory, IO) independently, mirroring how a full container engine might partition hardware resources for individual workloads.
Key Takeaway: Cgroup delegation provides a secure mechanism to grant unprivileged users administrative control over their own resource sub-trees, effectively enabling "self-service" resource orchestration within the constraints defined by the system administrator.