How Docker Uses cgroups for CPU Isolation: Limits, Not Fixed Cores

Docker CPU Isolation via cgroups

Docker uses cgroups (control groups) , a Linux kernel feature, to limit, account for, and isolate system resources for a group of processes. For CPU isolation, Docker leverages the CPU subsystem of cgroups to restrict a container's CPU usage.

Implementation Steps

Cgroups resource allocation: When a container starts, Docker adds its process group to a cgroup so the kernel can manage its resources.

Setting CPU limits: Users specify the maximum CPU cores a container can use via the --cpus parameter (e.g., --cpus=2). This limit is enforced through the cgroups CPU subsystem.

CPU scheduling: The cgroups CPU scheduler ensures container processes run only within their allocated CPU quota, preventing them from consuming all host CPU resources.

Can Other Processes Use CPUs Allocated to a Container?

No. Processes not managed by Docker remain in the default cgroup and can use all CPU resources not allocated to containers. Docker's CPU allocation only restricts the container's processes; it does not reserve physical cores exclusively for the container.

Does Each Container Get Exclusive CPUs?

Each container can be configured with its own CPU limit via --cpus. For example:

docker run --cpus=2 --name my_container my_image

This limits my_container to two CPU cores. The container's processes run on up to two cores, while other system processes use the remaining cores.

Are Allocated CPUs Fixed or Dynamically Scheduled?

Dynamic scheduling. The --cpus parameter sets an upper limit on the number of cores, not a fixed binding to specific cores.

Upper limit: --cpus=2 means the container cannot exceed two cores' worth of CPU time.

Dynamic allocation: The kernel scheduler decides which physical cores the container's threads run on at any moment, shifting them across available cores based on load. For instance, on an 8-core host, a container limited to two cores may run on cores 1 and 3 at one moment, and cores 5 and 7 later.

Summary

CPU isolation means a quantity limit , not fixed core affinity.

A container can use only up to its specified CPU quota.

No single CPU core is permanently bound to a container.

The specific cores used change dynamically, but the total CPU capacity available to the container is fixed.

This prevents any one container from monopolizing all CPU resources.