Container Basics On Linux (Namespaces/Cgroups)
Stop watching your runaway containers swallow the host memory
🧩 The Challenge
Dealing with a container that starts leaking memory and brings your entire database server to its knees is a total nightmare. It’s infuriating when one bad process ruins the host’s stability because nobody put a leash on its cgroup.
đź’ˇ The Fix
Use systemd-run to pin your containerized processes to a slice with strict memory limits, keeping the host safe from OOM panics. You’ll stop the “noisy neighbor” effect before it ruins your pager duty shift.
systemd-run --scope -p MemoryMax=512M -p MemorySwapMax=0 /usr/bin/podman run --rm nginx⚙️ Why It Works
This approach leverages the cgroup v2 controller directly to put a hard ceiling on memory usage for the process tree. It’s cleaner than guessing if the container engine’s own resource flags are actually being respected by the kernel.
🚀 Pro-Tip: Always set MemorySwapMax to 0 unless you want the kernel thrashing your physical disk to death.
Linux Tips & Tricks | © ngelinux.com | 10/25/2026