cgroups

tags : Linux, Containers

What? §

• A Linux kernel feature which allow processes to be organized into hierarchical groups whose usage of various types of resources can then be limited and monitored.
• See Control Group v2 — The Linux Kernel documentation

Core §

• cgroup core is primarily responsible for hierarchically organizing processes.

Controller §

• cgroup controller is usually responsible for distributing a specific type of system resource along the hierarchy
• Although there are utility controllers which serve purposes other than resource distribution.

Interface §

• The kernel’s cgroup interface is provided through a pseudo-filesystem called cgroupfs.

Namespace §

• See Linux Namespaces
• The CLONE_NEWCGROUP provides a mechanism to virtualize the “view” of the “/proc/$PID/cgroup” file and cgroup mounts. Without it it will show complete path of the cgroup of a process. Which may leak potential system level information to the isolated processes.
• In a container setup where we’re trying to isolate things, we want to use a namespace for cgroups so that it has an isolated view of cgroups.

cgroups vs ulimit §

ulimit §

• See ulimits
• A limit of 2 GiB main memory applies to a single process (and its threads). And a child process of this process inherits also a limit of 2 GiB main memory, but this is 2 GiB for its own usage.
• In other words, each process would have a limit of 2 GiB, and together they could consume up to 4 GiB of main memory.

cgroups §

• So, control groups allow to limit resources over a group of processes.
• Limiting the main memory to 2 GiB for a group containing 3 processes, means the main memory used by all 3 processes together may not exceed 2 GiB.

cgroupv1 & cgroupv2 §

• If /sys/fs/cgroup/cgroup.controllers is present on your system, you are using v2, otherwise you are using v1.
• cgroup2 · Control and maximize resource utilization
• About cgroup v2 | Kubernetes
• Control Group v2 — The Linux Kernel documentation