World map

 

BM

World D6: Under the Hood

cgroups: what it can use

You will learn: how cgroups cap a container's memory, CPU and processes, and what happens at the cap.

Checked with Docker Engine 29 on 31 Oct 2026

The problem

One lunchbox has a memory leak. It eats and eats. Your laptop has 16 GB. What happens to the other lunchboxes?

Watch

Turn on all three limits. Watch the Limits panel.

What it can use (cgroups)

  • Limits

    Memory
    No limit: all 16 GB
    CPU
    No limit: all 8 CPUs
    Processes
    No limit

Linux has portion limits called cgroup: A portion limit: how much memory and CPU, and how many processes, a container may use.. A cgroup caps memory, CPU or the number of processes.

Try it

Give a new nginx, web, a 256 MB portion. Then check it with docker stats --no-stream.

Your laptop~

  • No open hatches

Lunchboxes (containers)

  • No containers yet

Frozen packs (images)

  • alpine:3.221 layers · 12.9MB
  • nginx:1.30-alpine8 layers · 93.5MB
  • node:24-alpine4 layers · 244MB

Predict

The app keeps eating memory, far past its cap. What does Linux do?

Check

bash
docker run --name hog --memory 32m --memory-swap 32m alpine:3.22 tail /dev/zero
echo $?
137
docker inspect -f '{{.State.OOMKilled}}' hog
true
docker rm hog
hog

Real output. tail /dev/zero eats memory forever. Exit code 137 means “killed”. OOMKilled means out of memory: it hit its cap.

Check

Namespace or cgroup? Sort each one.

Drag a card into a box. Or tap the card, then tap the box.

      You did it!

      You can now cap what a container may use.

      Go deeper (optional)

      Docker always puts a container in its own cgroup, but sets no cap unless asked. With cgroup v2, caps live in files: memory.max, cpu.max, pids.max. A CPU cap only slows a box down. It never kills it. Only use tail /dev/zero with a memory cap!

      Real mission

      1. docker run -d --name web --memory 256m --cpus 0.5 --pids-limit 100 nginx:1.30-alpine
      2. docker stats --no-stream web
      3. docker rm -f web

      0 of 3 steps done · Your ticks are saved.