containers • Intermediate

Control Groups (cgroups v2): CPU Quotas & The OOM Killer

While Namespaces control WHAT a container can see, Control Groups (cgroups) control HOW MUCH host resources (CPU cycles, Memory, Disk I/O, PIDs) a container is permitted to consume.

Intuitive Mental Model

The Hotel Keycard Power Limiter: Namespaces give you the hotel room; Cgroups restrict the air conditioner to 500 Watts (CPU quota) and turn off the lights if you use more than 100 Gallons of water (OOM Killer).

Dockerfile / YAML Manifest / CLIProduction Standard

# Run container with 512MB RAM limit and 0.5 CPU quota:
docker run -d \
  --name web-app \
  --memory="512m" \
  --memory-swap="512m" \
  --cpus="0.5" \
  nginx:alpine

# Under the hood: Linux CFS (Completely Fair Scheduler) quota:
# /sys/fs/cgroup/memory.max = 536870912 (512MB)
# /sys/fs/cgroup/cpu.max = 50000 100000 (50ms per 100ms period = 0.5 CPU)

Key Architectural Takeaways

•CPU Limits: The Linux CFS scheduler throttles CPU cycles by pausing process execution if quota is exhausted within a 100ms period.
•Memory Limits: If a container exceeds its memory.max threshold and swap is disabled, the Linux Kernel OOM Killer immediately terminates the container with Exit Code 137 (SIGKILL 9 + 128).
•cgroups v2 provides a unified hierarchy, eliminating resource contention bugs present in v1.

Common Production Mistake

Setting aggressive CPU limits on latency-sensitive Node.js/Go services, causing severe tail-latency spikes due to CFS throttling.