Container Basics On Linux (Namespaces/Cgroups)

Stop your containers from being memory hungry ghosts

🧩 The Challenge

Dealing with a container that keeps getting OOM-killed while the host reports plenty of free RAM is enough to make anyone scream. You spend hours checking app logs, but the kernel is just silently reaping your process because you didn’t tell it how much memory it’s actually allowed to touch.

💡 The Fix

Use cgroups to enforce hard memory limits on the process tree so the kernel stops guessing your intent. It keeps your app inside its lane and prevents it from stealing resources from the rest of the host.

cgcreate -g memory:/my_limited_app
cgset -r memory.limit_in_bytes=512M my_limited_app
cgexec -g memory:/my_limited_app /usr/local/bin/my_app

⚙️ Why It Works

This works by attaching your process to a specific control group that tracks usage against a defined ceiling, forcing the kernel to trigger an OOM event only when that specific limit is hit. You aren’t just trusting the app to play nice; you’re setting the boundaries at the syscall level.

🚀 Pro-Tip: Run cgtop if you want to watch the memory usage of your cgroups in real-time without digging through /sys/fs/cgroup.

Linux Tips & Tricks | © ngelinux.com | 7/18/2026