Understanding Linux cgroups and Controlling Process CPU Usage

1. Introduction

This article explains how to limit resources of containers (or any Linux process) using the kernel feature called cgroup (control groups). It describes the environment (a Linux host running containers) and the goal of limiting CPU, memory, network, etc.

2. Background

Container technology is widely used, but uncontrolled resource consumption can destabilize the host. cgroup provides a kernel‑level mechanism to control resources for any process, not only containers.

3. Purpose

To explore the principles of cgroup, master its usage, and demonstrate the effect through a hands‑on experiment that limits a process’s CPU usage.

4. Linux Core Technology – cgroup

4.1 Basic Introduction

cgroup (control groups) is a Linux kernel feature that can limit, control, and isolate resources (CPU, memory, network, disk I/O, etc.) for a group of processes. It was developed by Google and became available in kernel 2.6.24 (January 2008).

Cgroup Terminology

The term “subsystem” (or controller) refers to a specific resource controller, such as cpu , memory , etc. You can view supported subsystems with cat /proc/cgroups .

Cgroup Functions

cgroup provides four main capabilities: resource limiting, priority allocation, resource statistics, and process control.

4.2 Usage Method

Place a process into a cgroup directory and set the appropriate control files. The relationship is similar to users and groups: a user ID belongs to a group ID; likewise, a process PID belongs to a cgroup task, inheriting the group’s resource limits.

5. Experiment – Limiting Process CPU Usage with cgroup

The experiment focuses on the cpu subsystem, which controls CPU usage.

5.1 Experiment Goal

Restrict a process to 25% of a CPU.

5.2 Experiment Steps

1. Create a test cgroup under /sys/fs/cgroup/cpu (e.g., mkdir testlimit ). The kernel automatically creates the necessary control files.

2. Identify the two key control files:

cpu.cfs_quota_us : default 100000 µs (the amount of CPU time allowed per period).

cpu.cfs_period_us : default -1 (no limit). To achieve 25% usage, set the period to 100000 µs and the quota to 25000 µs.

3. Adjust the parameters:

echo 25000 > /sys/fs/cgroup/cpu/testlimit/cpu.cfs_quota_us

4. Generate CPU load with a busy loop (e.g., a bash infinite loop) to observe the effect.

5. Add the PID of the busy process to the cgroup:

echo
> /sys/fs/cgroup/cpu/testlimit/tasks

6. Observe the CPU usage drop to approximately 25%.

5.3 Experiment Result

The monitored bash process’s CPU usage decreased to around 25%, confirming that the cgroup limits are effective.

6. Conclusion

cgroup is a kernel‑level control mechanism applicable to all processes, including containers. By configuring cgroup parameters before container start‑up and adding the container’s PID to the appropriate cgroup after launch, resource usage can be reliably constrained.