In this lesson, you will learn how to create nested, parent-child resource constraints to strictly govern how processes share system resources using Cgroup v2.
The Concept of Hierarchy
In Cgroup v2, the system acts like a tree. You start at the root (/sys/fs/cgroup/) and create subdirectories, which represent "control groups." Each directory inherits the resource constraints of its parent, allowing you to slice up total system resources (like CPU or Memory) into smaller, manageable portions for specific applications or users.
Imagine you have a web server. You want to ensure the entire server cannot exceed 4GB of RAM, but you also want to guarantee that its "Database" child process doesn't consume more than 2GB of that total.
Configuring Nested Limits
To enforce this, you move process PIDs into these directories and write values to the controller files. Because the hierarchy is strictly enforced, the child group can never exceed the limits set by the parent group.
Here is how you would structure these limits on a modern Linux system:
# 1. Create a parent group for your application
mkdir /sys/fs/cgroup/web_app
# 2. Limit the parent to 4GB of RAM
echo "4G" > /sys/fs/cgroup/web_app/memory.max
# 3. Create a nested group for the database component
mkdir /sys/fs/cgroup/web_app/database
# 4. Limit the database to 2GB
# Even if the system has 64GB of RAM, this group is capped by
# its own 2GB limit AND the parent's 4GB limit.
echo "2G" > /sys/fs/cgroup/web_app/database/memory.max
# 5. Add a process to the nested group
echo 1234 > /sys/fs/cgroup/web_app/database/cgroup.procs
Why this matters
By nesting these limits, you create a "resource budget." If you add a new sub-group for logging or monitoring, those tasks also draw from the web_app parent’s 4GB pool. This prevents any single process within your application architecture from starving the others or impacting the host OS. The kernel handles the enforcement, ensuring that as soon as the limit is hit, the processes inside are throttled or subjected to the OOM (Out of Memory) killer depending on your specific configuration.
Key Takeaway: Cgroup v2 hierarchical limits allow you to delegate resource management by ensuring sub-groups inherit and respect the strict boundaries set by their parent containers.