Container Basics On Linux (Namespaces/Cgroups)

Stop wondering why your cgroup limits are being ignored by systemd

🧩 The Challenge

You finally define a memory limit for your service, restart it, and watch it balloon way past the threshold until the OOM killer nukes everything. Turns out systemd loves to silently override your manual tweaks because it thinks it knows better.

💡 The Fix

Don’t mess with the cgroup files directly under /sys/fs/cgroup; instead, use systemd-run to spawn your process and let the init system manage the resource controller constraints properly. It keeps the audit trail clean and stops the kernel from fighting your config.

systemd-run --unit=my-test-app --property=MemoryMax=500M --property=CPUQuota=20% /usr/bin/python3 my_heavy_script.py

⚙️ Why It Works

By going through systemd-run, you force the system to register your slice with the manager, which prevents the cgroup hierarchies from becoming a disconnected, unmanaged mess. Under the hood, this creates a transient unit that forces the kernel to enforce your constraints as a first-class citizen of the service tree.

🚀 Pro-Tip: Use systemd-cgtop to see exactly how those limits are holding up in real-time.

Linux Tips & Tricks | © ngelinux.com | 8/6/2026