Configuring Resource Isolation with systemd Unit Files on Linux 7

To configure resource isolation for a program, you typically create or modify cgroup controller files, but on Linux 7 you can also adjust isolation settings through systemd unit files.

1. Modify systemd unit file

There are two ways to change resource isolation for a systemd‑managed program:

Command‑line modification using systemctl set-property name parameter=value, which takes effect immediately.

Manual editing of the program's unit file followed by systemctl daemon-reload and restarting the service with systemctl restart name.service.

Common resource isolation directives supported in a unit file include: CPUQuota=value – maximum CPU time the service may use (percentage, >100% allows more than one CPU core). It maps to the cgroup controller cpu.cfs_quota_us. MemoryLimit=value – maximum memory the service may use (suffixes K, M, G, T accepted). It maps to the cgroup controller memory.limit_in_bytes.

For a complete list of options, refer to the official Red Hat documentation: Modifying Unit Files .

1.2 Experiment

Using MySQL as an example, the experiment was performed on a CentOS 7.5 system with a 4‑core CPU.

When the CPU limit was set to 1 core ( CPUQuota=100%), MySQL’s CPU usage stayed around 100%.

After changing the limit to 2 cores ( CPUQuota=200%), MySQL’s CPU usage stabilized around 200% during write operations.

Images illustrating the system state before and after the change are included in the original article.

2. Brief Principle Explanation

System resources are represented in cgroups as resource controllers; each controller manages a specific resource via a hierarchical directory structure. systemd automatically mounts controllers such as cpu, blkio, and memory under /sys/fs/cgroup at boot.

systemd uses three unit types for resource management: service – a system service. slice – a group of hierarchically organized units. scope – an externally created process.

During system startup, a set of default services and four essential slices are created: -.slice (root), system.slice, user.slice, and machine.slice.

In Linux 7, resource isolation is achieved by matching the path of a program’s systemd unit in the systemd hierarchy with the corresponding cgroup controller path; the unit file’s resource parameters directly affect the linked cgroup controller.

Thus, editing the relevant resource‑related parameters in a systemd unit file enables the desired isolation.