Container Basics On Linux (Namespaces/Cgroups)

Stop watching your runaway containers swallow the host memory

🧩 The Challenge

Dealing with a container that starts leaking memory and brings your entire database server to its knees is a total nightmare. It’s infuriating when one bad process ruins the host’s stability because nobody put a leash on its cgroup.

💡 The Fix

Use systemd-run to pin your containerized processes to a slice with strict memory limits, keeping the host safe from OOM panics. You’ll stop the “noisy neighbor” effect before it ruins your pager duty shift.

systemd-run --scope -p MemoryMax=512M -p MemorySwapMax=0 /usr/bin/podman run --rm nginx

⚙️ Why It Works

This approach leverages the cgroup v2 controller directly to put a hard ceiling on memory usage for the process tree. It’s cleaner than guessing if the container engine’s own resource flags are actually being respected by the kernel.

🚀 Pro-Tip: Always set MemorySwapMax to 0 unless you want the kernel thrashing your physical disk to death.

Linux Tips & Tricks | © ngelinux.com | 10/25/2026