How Does Docker Enforce CPU Isolation with Cgroups?

How Docker Implements CPU Isolation

Docker uses Linux cgroups (control groups) to limit, account for, and isolate system resources for a group of processes. For CPU isolation, Docker utilizes the CPU subsystem of cgroups to restrict container CPU usage.

Steps Docker Takes for CPU Isolation

Cgroups resource allocation: When a container starts, Docker adds its process group to a cgroup so the kernel can manage its CPU resources.

Setting CPU limits: Users can specify the number of CPU cores a container may use with the --cpus flag, which configures the cgroup CPU subsystem.

CPU scheduling: Docker relies on the cgroup CPU scheduler to ensure the container runs only within its allocated CPU range, preventing it from consuming all host CPU resources.

Thus Docker achieves CPU isolation by using cgroups to enforce bounded CPU usage while allowing other processes to use the remaining CPUs.

Can Other Processes Use CPUs Assigned to Docker?

Processes not placed in Docker’s cgroup remain in the default cgroup and can use any CPU resources not limited by Docker, so Docker’s CPU allocation does not prevent other processes from using those CPUs.

Is a Docker Container Tied to Specific CPUs?

When you launch a container with --cpus, you set an upper limit on CPU usage, not a fixed binding to particular cores. The kernel’s scheduler dynamically assigns the container’s processes to any available CPUs within that limit.

Example Command

docker run --cpus=2 --name my_container my_image

This limits the container to at most two CPU cores; the specific cores are chosen dynamically, and other system processes can still use the remaining CPU capacity.

Summary

CPU isolation limits the number of CPUs a container can use.

The limit is an upper bound, not a permanent binding to specific cores.

Other processes can still use any CPUs not consumed by the container.

The limit prevents a single container from monopolizing all CPU resources.