Container Basics On Linux (Namespaces/Cgroups)

Don’t let your container runaway and starve the host

🧩 The Challenge

Dealing with a rogue container that decides it needs every single CPU cycle on the host is a nightmare. I have spent way too many nights wondering why my monitoring agent stopped responding while a single app was spiking to 400 percent usage.

💡 The Fix

You need to apply cgroup v2 memory and CPU limits directly to the process group, even if you are just playing around with raw processes instead of using a full container engine. It is the only way to keep your system from locking up when your code goes sideways.

echo 100000 > /sys/fs/cgroup/my_app/cpu.max
echo 512M > /sys/fs/cgroup/my_app/memory.high
echo <pid> > /sys/fs/cgroup/my_app/cgroup.procs

⚙️ Why It Works

Writing these values into the cgroup filesystem forces the kernel to throttle the processes in that group the second they exceed your defined thresholds. You are essentially telling the kernel to put a leash on the task before it gets a chance to kill your server.

🚀 Pro-Tip: Always set memory.high slightly lower than your hard limit to trigger memory pressure stalls instead of getting OOM-killed immediately.

Linux Tips & Tricks | © ngelinux.com | 9/25/2026