Playing with cgroups for Fun and Profit


Hey there 👋

I spent a few weeks deep diving into cgroup v2, and I'm happy to share my findings with you!

Everyone knows that Docker and Kubernetes use cgroups to limit the resources of containers and Pods. But did you know that it's very easy to run an arbitrary Linux process in a cgroup using much more basic tools?

The only kernel's interface for cgroups is the virtual filesystem called cgroupfs typically mounted at /sys/fs/cgroup. Creating folders there and writing to files in them is technically all you need to get the job done.

While entertaining when performed once or twice, very few of us would want to regularly tune cgroups by writing to some obscure fs locations. Luckily there are higher-level helpers available. For instance, here is how you can run an app limiting its memory usage to 1000 MiB:

cgcreate -g memory:/new-cgroup

cgset -r memory.max="1000M" new-cgroup

gexec -g memory:new-cgroup ~/app

The above libcgroup tools are definitely handier than mkdir and echo, but my favorite finding is systemd-run! Not only can you demonize with it any long-running tasks, making them survive SSH disconnects and getting logs and status checks out of the box, but you can also limit their CPU and Memory usage with just two simple flags. And under the hood, systemd will configure a transient cgroup for you:

If you find the above tips useful, you can read more about practical ways of using cgroups in my most recent tutorial:

​Controlling Process Resources with Linux Control Groups​

And, of course, the best way to internalize the new knowledge is by solving a few hands-on problems:

​

Hope you will find cgroup as fun as I do now. Good luck!

Ivan

Get more powerful playgrounds, unlimited egress traffic, and full content access with iximiuz Labs Premium. Does your company have a learning and development budget? Then this expense most likely can be reimbursed.

Ivan Velichko

Building labs.iximiuz.com - a place to help you learn Containers and Kubernetes the fun way 🚀

Read more from Ivan Velichko

Hello 👋 Ivan's here with November's roundup of all things Linux, Containers, Kubernetes, and Server Side 🧙 What I was working on This month was (extremely) development-heavy. Two-thirds of it went into the implementation of custom playground machinery and a new Kubernetes "Omni" playground, and in the last part, I was unexpectedly busy with expanding the platform's capacity and launching a new server in India 🎉 The latter became possible thanks to the support of all of you who got the premium...

Hello, fellow server dweller 👋 I've got two exciting announcements to make. Starting with the shorter one, this year, I decided to give Black Friday a try. This is an experiment - iximiuz Labs hasn't done sales before and won't have any in the foreseeable future, at least not until next November. So, if you wanted to get a premium membership but the price felt too high, this is your rare chance to get it with a 50% discount. The offer is limited to exactly one week. Now, to the second, much...

Hello 👋 It's this time of the month again! My traditional roundup of all things Linux, Containers, Kubernetes, and Server Side, delivered straight into your inbox 📬 What I was working on October was very productive for me - I shipped no major iximiuz Labs features (it's always hard to resist the temptation!) and instead dedicated all my available time to content work. The main focus was on Container Images. It's the subject of the first module of my "panoramic" Docker course, and it is almost...