Linux cgroups & namespaces

Linux cgroups & namespaces

By At June 24, 2025 0


 

Linux cgroups & namespaces – From Basics to FAANG-level Mastery

🧩 Table of Contents

  1. What Problem Are We Solving?

  2. Overview: Linux Process Isolation

  3. 🔐 Linux Namespaces (All 8 Types)

  4. ⚙️ Linux Control Groups (cgroups v1 vs v2)

  5. cgroups + namespaces = Containers

  6. Hands-on Demos & Examples

  7. Advanced Use-Cases

  8. FAANG-Level Interview Questions & Answers

  9. Visual Summary & Cheat Table

🚩 1. What Problem Are We Solving?

Imagine a multi-user system or a container host:

  • How do you prevent one process from seeing others? 👉 Namespaces

  • How do you limit CPU/RAM per process/group? 👉 cgroups

  • How do you isolate processes like they're in separate machines? 👉 Combine both

📦 2. Overview: Linux Process Isolation

In default Linux:

  • All processes see the same process list, same filesystem, and compete for the same CPU/memory.

To isolate processes (e.g., in containers), Linux provides:

Feature

Purpose

Namespaces

Logical isolation (what a process can see)

cgroups

Resource isolation (how much a process can use)

🧱 3. Linux Namespaces – Logical Isolation

✅ What are Namespaces?

Namespaces provide per-process views of global system resources. Each namespace isolates one aspect of the system.

🧠 Chronological Explanation (1–8 Types)

Type

Isolates

CLI Example

1. pid

Process IDs

ps aux inside container

2. net

Network stack (IP, interfaces)

separate IPs in containers

3. mnt

Filesystems

isolated root (/) directory

4. uts

Hostname & domainname

hostname different per container

5. ipc

System V IPC, message queues

separate shared memory, semaphores

6. user

User and group IDs (UID/GID)

UID 0 in container != host root

7. cgroup

Cgroup namespace itself

View of resource limits

8. time

Time namespace

Clock offset, timens (v5.6+)

🌐 Namespace Example – Isolate hostname and PID

unshare --uts --pid --mount-proc bash

Inside new shell:
hostname FAANG-namespace
hostname   # outputs FAANG-namespace
ps -ef     # only processes inside this namespace


🔧 4. Linux Control Groups (cgroups) – Resource Management

✅ What are cgroups?

cgroups = control groups. They limit, account, and isolate the resource usage (CPU, memory, disk I/O, etc.) of groups of processes.

⚖️ What Can You Control with cgroups?

Resource

Control

CPU

Limit CPU shares or time

Memory

Set memory hard/soft limits

I/O (blkio)

Limit disk read/write rate

Network (net_cls)

Tag packets for traffic shaping

Devices

Restrict access to /dev entries

PID

Limit number of forked processes

HugeTLB

Control use of huge pages

📚 cgroups v1 vs cgroups v2

Feature

cgroups v1

cgroups v2

Hierarchy

Separate trees per controller

Unified hierarchy

Configuration

Multiple files per resource

Single file per cgroup

Resource limits

Per-controller granularity

Clean design, better integration

Adoption

Legacy & Docker default

Kubernetes prefers v2

🔥 Kubernetes & systemd now prefer cgroups v2.

⚙️ Basic cgroup Setup (v1)

mkdir /sys/fs/cgroup/cpu/mygroup
echo 100000 > /sys/fs/cgroup/cpu/mygroup/cpu.cfs_period_us
echo 20000  > /sys/fs/cgroup/cpu/mygroup/cpu.cfs_quota_us
echo $$     > /sys/fs/cgroup/cpu/mygroup/tasks


Above limits process to 20% CPU usage.

🔗 5. Combining Namespaces + cgroups = Containers

Containers (like Docker) are not a new kernel feature.

They're just:


Namespaces → process can't see host
cgroups → process can't hog resources

Union FS → makes layered images work
Container runtime (runc) → wires it together



Example: How Docker Uses Both

docker run -m 128m --cpus="0.5" alpine


  • Sets memory/cpu limits via cgroups

  • Starts PID/net/uts/mnt namespaces

  • Runs as root inside user namespace

🧪 6. Hands-on: DIY "Container"

sudo unshare --mount --uts --ipc --net --pid --user --fork --map-root-user bash


Inside:

hostname isolated

mount -t proc proc /proc


Now you’re in a mini container with isolated process tree, hostname, and resources!

🧠 7. Advanced Use-Cases

Use-Case

Namespace

cgroup Use?

Kubernetes Pod

All namespaces

CPU/mem/blkio isolation

Serverless Function

PID, net, user

Per-request limits

Sandboxing (gVisor)

All + syscall filtering

Yes

Android apps

Isolated UIDs, net ns

Memory cgroups

Timezone test env

time namespace

N/A

🎯 8. FAANG-Level Interview Q&A

❓Q1: How do cgroups and namespaces enable containers?

A: Namespaces isolate what a process sees (process list, filesystem, hostname), cgroups control how much it uses (CPU, memory). Together they make containers look and behave like VMs.

❓Q2: What happens when memory limit is exceeded in a cgroup?

A: Kernel invokes the OOM Killer inside that cgroup and terminates the largest memory-consuming process.

❓Q3: How do you apply a cgroup to an existing process?

echo <pid> > /sys/fs/cgroup/memory/mygroup/tasks


❓Q4: Can two containers share the same namespace?

A: Yes. You can use --pid=container:<name> in Docker to share PID namespace.

❓Q5: Difference between namespace and chroot?

Feature

chroot

Namespace

Isolates FS

✅

✅ (mnt namespace)

Isolates PID

❌

✅ (pid namespace)

Secure

❌

✅

🗂️ 9. Summary & Cheat Sheet

Concept

Description

Example Tool/Command

pid ns

Isolate process ID space

unshare --pid

net ns

Isolate network interfaces

ip netns

user ns

UID/GID mapping

--map-root-user

cgroups

Resource limits & accounting

/sys/fs/cgroup

runc

Runtime that applies both

runc run

cgroups v2

Unified resource hierarchy

/sys/fs/cgroup/cgroup.procs

✅ Final Thought

Containers are not magic.
 They're built using Linux kernel primitives:
 namespaces for isolation, and cgroups for limits.
 Mastering these is critical for systems, DevOps, and SRE roles at top companies.

More ref:

  • https://www.linkedin.com/pulse/linux-technologies-fundamental-containers-hossein-abedinzadeh-x9fjf/
  • https://amsekharkernel.blogspot.com/2016/11/what-is-linux-namespace-cgroups.html
  • https://medium.com/@mrdevsecops/namespace-vs-cgroup-60c832c6b8c8
  • https://thevirtualbuddha.com/2024/05/23/understanding-container-technology-the-magic-of-cgroups-and-namespaces/
  • https://www.alibabacloud.com/blog/getting-started-with-kubernetes-%7C-further-analysis-of-linux-containers_596290

Distributed by Gooyaabi Templates | Designed by OddThemes