Also known as: control groups · cgroup v2
cgroups (control groups) are a Linux kernel feature that limits, accounts for, and isolates the resource usage — CPU, memory, disk I/O, network — of a group of processes.
Where namespaces control what a process can see, cgroups control how much it can consume. Together they constitute the kernel foundation of container runtimes.
cgroup v2 unified the previously separate per-resource hierarchies into a single tree, resolving longstanding inconsistencies. Memory limits are the most operationally visible feature: exceeding one triggers the OOM killer, a common and often puzzling cause of container termination.
Namespace
A Linux namespace is a kernel feature that gives a process an isolated view of a particular system resource — process IDs, network interfaces, mount points, hostnames — forming the primary isolation mechanism behind containers.
Container
A container is a process or group of processes running in isolation on a shared kernel, using namespaces for visibility isolation and cgroups for resource limits, packaged with its own filesystem and dependencies.
Kernel
The kernel is the core of an operating system, responsible for managing memory, scheduling processes, and mediating all access between software and hardware. The Linux kernel is the component that makes a system 'Linux'.
systemd
systemd is the init system and service manager used by most major Linux distributions, handling service startup and supervision, logging, device management, and system state through a unified set of components.