Container Basics On Linux (Namespaces/Cgroups)

Stop letting one container starve your whole server of CPU

🧩 The Challenge

Dealing with a rogue container that decides to hog every single CPU cycle while your production database sits there gasping for air is a special kind of hell. You’ve been there, right, trying to SSH into the box while the load average is sitting at triple digits?

💡 The Fix

Use cgroups to put a hard cap on how much CPU time a specific process or container can steal. It keeps your system responsive even when your code goes haywire.

cgcreate -g cpu:/limit_group
cgset -r cpu.cfs_quota_us=50000 limit_group
cgexec -g cpu:limit_group /usr/bin/my-heavy-app

⚙️ Why It Works

By tweaking the CFS quota, you’re telling the kernel to force that process to pause once it hits its limit, essentially giving the CPU a breather. It’s like putting a speed governor on a kid who just drank five espressos.

🚀 Pro-Tip: Check /sys/fs/cgroup/cpu/limit_group/cpu.stat to see exactly how many times your process got throttled.

Linux Tips & Tricks | © ngelinux.com | 9/19/2026