Container Basics On Linux (Namespaces/Cgroups)

Stop processes from hogging all your CPU cycles inside a container

🧩 The Challenge

You finally deploy that microservice and suddenly your host server is gasping for air because a rogue process went into a tight loop. I’ve spent too many late nights tracking down which container was the culprit while the SSH session kept freezing.

💡 The Fix

Use cgroups to put a hard limit on how much CPU time a process can consume so it can’t kill your entire machine. It’s a lifesaver when you don’t fully trust the code running in production.

cgcreate -g cpu:/limited_app
cgset -r cpu.cfs_quota_us=50000 limited_app
cgexec -g cpu:limited_app ./your_application

⚙️ Why It Works

Setting the cfs_quota_us value defines exactly how many microseconds of CPU time the group gets within a 100ms window, effectively capping the usage to half a core. It creates a sandbox that prevents one greedy thread from starving every other service on the box.

🚀 Pro-Tip: Always monitor the cpu.stat file in your cgroup directory to see how often you are actually hitting those limits.

Linux Tips & Tricks | © ngelinux.com | 7/25/2026