Using Cgroups to Limit Process Resources

What are Cgroups?

Control groups (cgroups) are a Linux kernel feature that limits, accounts for, and isolates resource usage (CPU, memory, disk I/O) of processes. They are the foundation of container resource limits.

Install Tools

sudo apt install -y cgroup-tools

Limit CPU Usage

# Create a cgroup
sudo cgcreate -g cpu:/limited

# Limit to 50% of one CPU core
echo 50000 | sudo tee /sys/fs/cgroup/cpu/limited/cpu.cfs_quota_us
echo 100000 | sudo tee /sys/fs/cgroup/cpu/limited/cpu.cfs_period_us

# Run a process in the cgroup
sudo cgexec -g cpu:/limited ./heavy-process

Limit Memory

sudo cgcreate -g memory:/limited

# Limit to 512 MB
echo 536870912 | sudo tee /sys/fs/cgroup/memory/limited/memory.limit_in_bytes

sudo cgexec -g memory:/limited ./memory-hungry-app

Using systemd (Recommended)

Systemd services support cgroup limits natively:

[Service]
CPUQuota=50%
MemoryMax=512M
IOWeight=50
TasksMax=100

Monitoring

# View cgroup resource usage
systemctl status myapp.service
cat /sys/fs/cgroup/memory/limited/memory.usage_in_bytes