tags : Linux, Containers

What?

Core

  • cgroup core is primarily responsible for hierarchically organizing processes.

Controller

  • cgroup controller is usually responsible for distributing a specific type of system resource along the hierarchy
  • Although there are utility controllers which serve purposes other than resource distribution.

Interface

  • The kernel’s cgroup interface is provided through a pseudo-filesystem called cgroupfs.

Namespace

  • See Linux Namespaces
  • The CLONE_NEWCGROUP provides a mechanism to virtualize the “view” of the “/proc/$PID/cgroup” file and cgroup mounts. Without it it will show complete path of the cgroup of a process. Which may leak potential system level information to the isolated processes.
  • In a container setup where we’re trying to isolate things, we want to use a namespace for cgroups so that it has an isolated view of cgroups.

cgroups vs ulimit

ulimit

  • See ulimits
  • A limit of 2 GiB main memory applies to a single process (and its threads). And a child process of this process inherits also a limit of 2 GiB main memory, but this is 2 GiB for its own usage.
  • In other words, each process would have a limit of 2 GiB, and together they could consume up to 4 GiB of main memory.

cgroups

  • So, control groups allow to limit resources over a group of processes.
  • Limiting the main memory to 2 GiB for a group containing 3 processes, means the main memory used by all 3 processes together may not exceed 2 GiB.

cgroupv1 & cgroupv2