Container Basics On Linux (Namespaces/Cgroups)

Stop your container memory limits from becoming a silent lie

🧩 The Challenge

You ever see a container hitting its memory limit and getting killed, but the application inside reports it has plenty of headroom? I spent an entire afternoon debugging a Java app that kept crashing because the JVM thought it owned all the host RAM, ignoring the cgroup fence I’d built around it.

💡 The Fix

Use the memory cgroup controller to actually force the kernel to account for the container’s usage, and make sure your runtime isn’t reporting the host’s stats instead of the slice’s stats. It’s the only way to keep your processes honest when they start growing.

cat /sys/fs/cgroup/memory/your_container_name/memory.usage_in_bytes
cat /sys/fs/cgroup/memory/your_container_name/memory.limit_in_bytes

⚙️ Why It Works

Peeking directly into the cgroup filesystem bypasses whatever abstraction layer is lying to your application. This reveals exactly what the kernel sees, letting you see if the hard limit is actually being enforced as expected.

🚀 Pro-Tip: If you’re on a modern cgroup v2 system, check memory.current instead of usage_in_bytes because the interface shifted under our feet.

Linux Tips & Tricks | © ngelinux.com | 8/15/2026