Container Basics On Linux (Namespaces/Cgroups)

Stop wondering if your container process is actually seeing the right host resources

🧩 The Challenge

You ever wonder if that app in your container is actually restricted by the cgroup limits you set, or if it’s just ignoring them and eating all your system memory? It’s infuriating when you think you’ve capped a container to 512MB, but it keeps killing off other services on the host.

💡 The Fix

Look directly at the cgroup pseudo-filesystem to see the truth of what the kernel is enforcing versus what the process thinks it sees. Checking the memory controller stats beats trusting the container runtime’s reported stats any day of the week.

grep -E 'memory\.(current|max)' /sys/fs/cgroup/system.slice/docker-<container-id>.scope/memory.current

⚙️ Why It Works

Because these files represent the live interface between your process and the Linux kernel, they bypass any middleman software that might be lying to you. Everything else is just a wrapper; this is where the actual resource accounting happens.

🚀 Pro-Tip: Use the cat command on the full cgroup file if you want the raw numbers in bytes without the grep filtering.

Linux Tips & Tricks | © ngelinux.com | 7/19/2026