Container Basics On Linux (Namespaces/Cgroups)
Stop processes from hogging all your CPU cycles inside a container
🧩 The Challenge
You finally deploy that microservice and suddenly your host server is gasping for air because a rogue process went into a tight loop. I’ve spent too many late nights tracking down which container was the culprit while the SSH session kept freezing.
đź’ˇ The Fix
Use cgroups to put a hard limit on how much CPU time a process can consume so it can’t kill your entire machine. It’s a lifesaver when you don’t fully trust the code running in production.
cgcreate -g cpu:/limited_app
cgset -r cpu.cfs_quota_us=50000 limited_app
cgexec -g cpu:limited_app ./your_application⚙️ Why It Works
Setting the cfs_quota_us value defines exactly how many microseconds of CPU time the group gets within a 100ms window, effectively capping the usage to half a core. It creates a sandbox that prevents one greedy thread from starving every other service on the box.
🚀 Pro-Tip: Always monitor the cpu.stat file in your cgroup directory to see how often you are actually hitting those limits.
Linux Tips & Tricks | © ngelinux.com | 7/25/2026