Cgroups

In the previous article we saw how namespaces make one machine look like several: each group of processes gets its own hostname, its own pid 1, its own network. But we ended on a problem. A process with all of that can still eat every CPU core and every byte of RAM on the box. Namespaces decide what a process can see. They say nothing about how much it can use.