How Does Docker Enforce CPU Isolation with cgroups?

Docker CPU Isolation Mechanism

Docker uses Linux cgroups (control groups) to implement CPU isolation. Cgroups allow the kernel to limit, account for, and isolate the CPU resources of a group of processes, and Docker utilizes the CPU subsystem of cgroups to restrict container CPU usage.

Cgroups resource allocation: When a container starts, Docker adds its process group to a cgroup so the kernel can manage its CPU resources.

Setting CPU limits: Users can specify the number of CPU cores a container may use with the --cpus option, which Docker enforces via the cgroups CPU subsystem.

CPU scheduling: Docker relies on the CPU scheduler within cgroups to ensure the container runs only within its allocated CPU range, preventing it from consuming all host CPU resources.

Can other processes use CPUs assigned to Docker?

Processes not placed in Docker's cgroup remain in the default cgroup and can use all CPU resources. Therefore, assigning CPUs to a Docker container does not prevent other host processes from using the unassigned CPUs.

Is a Docker container bound to specific CPUs?

Each Docker container can be configured to use a limited number of CPU cores via the --cpus flag, but the cores are not statically bound; they are scheduled dynamically within the specified limit.

Example command

docker run --cpus=2 --name my_container my_image

Is the CPU assignment fixed or dynamic?

Using --cpus sets an upper limit on CPU usage, not a fixed set of cores. The Linux kernel dynamically schedules the container’s processes across available CPUs, allowing flexibility based on system load.

Summary

CPU isolation limits the number of CPUs a container can use, while the specific CPUs are allocated dynamically, ensuring containers cannot monopolize host CPU resources.