Container Basics On Linux (Namespaces/Cgroups)

Stop cgroups from turning your server into a brick

🧩 The Challenge

You ever have a batch script go rogue and eat every last byte of RAM, effectively turning your production server into an expensive paperweight? It’s miserable when the OOM killer starts nuking your database instead of the actual culprit.

💡 The Fix

Use systemd-run to wrap that unruly process in its own transient scope so you can enforce hard memory and CPU limits on the fly. You’ll keep the rest of your system breathing even when the script tries to run wild.

systemd-run --user --scope -p MemoryMax=500M -p CPUQuota=20% ./your-memory-hungry-script.sh

⚙️ Why It Works

By shoving the process into a temporary slice, you’re tapping into the underlying cgroup controllers that force the kernel to hard-cap how much hardware the process can touch. It is basically putting guardrails on a runaway train before it leaves the station.

🚀 Pro-Tip: Check your current slice limits using systemd-cgtop to see exactly how much pressure your tasks are putting on the hardware in real-time.

Linux Tips & Tricks | © ngelinux.com | 8/11/2026