Resource Limits & cgroups

Published on:

Most important commands to remember

  • systemd-run --user — create a transient service for your user.
  • systemctl --user show — inspect its configured resource properties.
  • systemctl --user stop — stop the disposable service.

Commands and flags

Command or option Meaning
--user Use your user service manager, not the system manager.
--unit=btc-cgroup-lab --collect Name the temporary unit and unload it after completion, including failure.
--property=CPUQuota=20% Allow up to 20% of one CPU’s time over the quota period.
--property=MemoryMax=64M Set a 64 MiB memory ceiling; swap has separate controls.
--property=TasksMax=16 Limit tasks, including threads, to sixteen.
sleep 120 Keep a harmless process alive for at most 120 seconds.
show … -p PROPERTY Print only the selected properties.
stop btc-cgroup-lab.service End this example’s service.

The concepts that matter

1. A cgroup accounts for a group of processes

A control group, or cgroup, organizes processes for resource accounting and control. Controllers can govern CPU, memory, task counts, and other resources. Descendant processes generally remain within the relevant group hierarchy unless moved.

This complements namespaces: a process can have an isolated view but still compete for unlimited resources, or share a view while having a strict resource budget. Visibility and consumption are different controls.

2. CPU quota is a time budget

A CPU quota limits CPU time over a scheduling period. A 20% quota represents one fifth of one CPU’s capacity, not one fifth of every CPU in the machine. A value above 100% can allow aggregate work across multiple CPUs.

Quota does not pin work to a particular CPU and does not guarantee latency. Once a busy group exhausts its budget, throttling can delay runnable work. CPU weight, by contrast, expresses relative sharing under competition rather than a fixed ceiling.

3. Memory and task limits fail differently

A memory ceiling can trigger reclaim and, when the group cannot stay within the limit, an out-of-memory response affecting its processes. It is not simply a request for the application to slow down.

A task limit constrains processes and threads. Reaching it can make further task creation fail even when memory remains available. Distinguish a memory failure, a thread-creation failure, and CPU throttling; increasing the wrong limit will not address the cause.

4. The hierarchy constrains the effective budget

Cgroup v2 organizes groups into a hierarchy. Parent restrictions also constrain descendants, so a generous child setting cannot override a tighter effective ancestor limit.

Service managers and container runtimes translate configuration into this hierarchy. Inspect the actual group and effective context rather than assuming the application received the entire requested budget. Configuration inspection and a measured stress test answer different questions.

One small example

Optional: run as your ordinary user with the stated delegated controllers. If the unit name already exists or creation fails, stop rather than reusing that unit. Run the inspection before the 120-second sleeper exits.

systemd-run --user --unit=btc-cgroup-lab --collect --property=CPUQuota=20% --property=MemoryMax=64M --property=TasksMax=16 sleep 120
systemctl --user show btc-cgroup-lab.service -p ControlGroup -p CPUQuotaPerSecUSec -p MemoryMax -p TasksMax
systemctl --user stop btc-cgroup-lab.service

ControlGroup identifies the service’s cgroup path. MemoryMax should represent 67108864 bytes and TasksMax sixteen. CPUQuotaPerSecUSec may be formatted as a duration corresponding to 200 milliseconds of CPU time per second of capacity.

The sleeper consumes little CPU and memory, so this only inspects configured limits; it does not demonstrate throttling or OOM behavior. The final stop ends the sleeper, and collect removes the transient unit. If inspection occurs after it exits, a missing unit is expected. No persistent unit file is installed.

Keep this idea: Cgroups control how much a process group can consume; the effective budget includes its parent constraints and controller support.