Container Security, 2nd Edition

Chapter 3. Control Groups

In this chapter, you will learn about one of the fundamental building blocks that are used to make containers: control groups, more commonly known as cgroups.

Cgroups limit the resources, such as memory, CPU, and network input/output, that a group of processes can use. In containers, they are used to distribute resources across different workloads in a controlled fashion. From a security perspective, well-tuned cgroups can ensure that one process can’t affect the behavior of other processes by hogging all the resources—for example, using all the CPU or memory to starve other applications. You can also limit the total number of processes allowed within a control group—a handy technique to protect against fork bombs, which I’ll cover at the end of the chapter.

As you will see in detail in Chapter 4, containers run as regular Linux processes, so cgroups can be used to limit the resources available to each container.

Note

Most Linux distributions today use cgroups version 2, which has some improvements over the original implementation that was widely deployed when containers first became popular. Cgroups v2 is now what’s used by Kubernetes and all the popular container runtimes, and it’s what is discussed here. However, you might find some references to v1 in older literature.

The main difference is that version 2 uses a single, unified hierarchy for managing all the supported resource types rather than having separate hierarchies for the different types ...