A cgroup, or Linux Control Group, groups processes and limits, accounts for, and isolates their use of resources such as CPU, memory, disk, and network bandwidth. It prevents one process or container from consuming resources reserved for others. section 2.3.3
Namespaces control which resources a process can see; cgroups control how much of those resources it can consume. Without cgroups, a container may access all available CPU cores and system memory. section 2.3.3
Docker exposes common cgroup limits through container-run options:
- Select permitted CPU cores with --cpuset-cpus. section 2.3.3
- Limit CPU time with --cpus, --cpu-period, --cpu-quota, or --cpu-shares. section 2.3.3
- Limit memory and swap usage with --memory, --memory-reservation, --kernel-memory, --memory-swap, and --memory-swappiness. section 2.3.3
$ docker run --cpuset-cpus="1,2" ...
Restrict a container to selected host CPU cores with Docker's --cpuset-cpus option. section 2.3.3
$ docker run --cpus="0.5" ...
Allow a container to use half of one CPU core with Docker's --cpus option. section 2.3.3
$ docker run --memory="100m" ...
Set a container's maximum memory size with Docker's --memory option. section 2.3.3
Cgroups help prevent resource starvation but do not make containers fully secure: their processes still share the system kernel. Capabilities, seccomp, AppArmor, and SELinux provide additional isolation. section 2.3.4 section 2.4
