cgroups v2

kernel-featureopen source

The kernel mechanism that meters and limits a group of processes' CPU, memory, I/O, and PIDs.

Control groups account for and cap the resource use of a set of processes, CPU shares, memory ceilings, block-I/O weights, PID counts. Where namespaces control what a process can see, cgroups control how much it can consume, containing resource-abuse and fork-bomb style denial of service. cgroups v2 unifies the earlier per-controller hierarchies into one tree. It is the second pillar (with namespaces) under container runtimes.

Strengths

Hard limits on CPU, memory, I/O, and process count
Contains resource-abuse and denial-of-service from within a container
Unified single-hierarchy model in v2

Limitations

Governs resource consumption, not access, not a security boundary by itself
Shared kernel, does nothing against a kernel-level escape
Needs pairing with namespaces + seccomp to make a container

Taught in

2. Anatomy of a container 4. microVMs, and the primitives you already know

Powers

Docker Podman containerd runc crun Incus

Compare with

Linux namespaces Linux capabilities

Sources

Kernel docs: cgroup v2