Container Basics On Linux (Namespaces/Cgroups)
Stop your container from leaking pids and taking down the host
🧩 The Challenge
Ever had a rogue process fork bomb inside a container and take the entire host kernel down with it? I’ve spent way too many nights rebooting servers because one developer’s script decided to spawn a million zombie processes.
đź’ˇ The Fix
Use cgroups to put a hard ceiling on the number of tasks a container can create. It’s the easiest way to prevent a single pod from locking up your entire node.
echo 500 > /sys/fs/cgroup/pids/my-app/pids.max⚙️ Why It Works
Setting a value in pids.max tells the kernel exactly how many concurrent processes that specific cgroup is allowed to track before it starts rejecting new forks. Since most containers shouldn’t be running hundreds of tasks, this puts a lid on the damage before it ripples out to the host.
🚀 Pro-Tip: Check /sys/fs/cgroup/pids/cgroup.procs to see which PIDs are actually sucking up your budget.
Linux Tips & Tricks | © ngelinux.com | 8/14/2026