Container Basics On Linux (Namespaces/Cgroups)

Stop containers from eating your entire CPU core budget

🧩 The Challenge

You finally got your app containerized, but then a single buggy background job decides it needs to hog 100 percent of your CPU, effectively starving every other service on the host. It’s infuriating when one misbehaving process turns your entire server into an expensive paperweight because you forgot to put a leash on it.

💡 The Fix

You need to set a hard CPU quota using cgroups, which prevents the container from bursting past a set limit regardless of how many threads it spawns. This keeps your system responsive even if your application code goes off the rails.

echo 50000 > /sys/fs/cgroup/cpu/my_container/cpu.cfs_quota_us
echo 100000 > /sys/fs/cgroup/cpu/my_container/cpu.cfs_period_us

⚙️ Why It Works

Setting the quota to half the period value forces the kernel to throttle the processes in that group once they hit the limit, ensuring they can’t consume more than that slice of CPU time per period. This creates a hard ceiling that the scheduler will strictly enforce.

🚀 Pro-Tip: Check /sys/fs/cgroup/cpu/my_container/cpu.stat to see how many times you have actually been throttled so you know if your limit is too tight.

Linux Tips & Tricks | © ngelinux.com | 8/19/2026