https://lesitedefrancois.be/en/tags/resources/Recent content in Resources on Le Site de FrançoisHugo -- gohugo.ioen© 2026 Françoishttps://lesitedefrancois.be/en/security/cgroups/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/cgroups/<p><strong>Control Groups (cgroups)</strong> is a Linux kernel mechanism, introduced in 2.6.24 (2008), that organises processes into a hierarchy of named groups and uses <strong>controllers</strong> to account for and limit each group&rsquo;s consumption of CPU time, memory, I/O bandwidth, and process count. Every container runtime in existence — Docker, containerd, CRI-O, Podman — uses cgroups to enforce the resource limits declared in a container spec (<code>--memory</code>, <code>--cpus</code>, <code>requests.memory</code>, <code>limits.cpu</code>). Every systemd service on a modern Linux system runs in its own cgroup slice. Without cgroups, a container or service could consume all available memory, CPU, or file descriptors, starving other workloads on the same host. The current production version is <strong>cgroups v2</strong> (also written cgroupv2, unified hierarchy), stable since kernel 4.5 and the default on all major distributions since RHEL 9, Ubuntu 21.10, and Fedora 31.</p>