<img loading="lazy" decoding="async" class="alignnone" style="height: 461px; width: 461px;" src="https://lh7-us.googleusercontent.com/8Hdro4HapSCktd3brRgaWf14AYacdbduV-TLnCmL_09iGVghDfVG39F2coEWIbyprrrUF9cWQn2_wqRnxcJMN9kSSHJ90EvNZTRJLWl0OitHbUgHif0a_yC4L-hOLfb_LavrnsDJxEHo9oAv8zK8fqk" alt="linux control group" width="1024" height="1024" />

Linux Control Groups, commonly known as Cgroups play a role, in Linux for managing system resources. They provide a structure to control and monitor resources like CPU and memory allowing administrators to assign and limit resources for processes or process groups. This article explores the intricacies including how to create and manage them as their significance in containerization.
<h2>Introduction to Hierarchies</h2>
It organize system resources into hierarchies with each hierarchy being managed by its controller. Every Linux process belongs to a Cgroup for each type of resource inheriting the Cgroups from its parent process when created.

The Linux kernel communicates information  through pseudofilesystems, usually located at `/sys/fs/cgroup`. You can list the different types of Cgroups on your system with the following command:
<pre><code>root@vagrant:/sys/fs/cgroup$ ls

blkio cpu,cpuacct freezer net_cls perf_event systemd

cpu cpuset hugetlb net_cls,net_prio pids unified

cpuacct devices memory net_prio rdma</code></pre>
These directories represent various resource controllers, such as CPU, memory, and more.
<h2>Managing </h2>
Managing involves reading and writing to the files and directories within these hierarchies. Let&#8217;s examine the memory hierarchy as an example:
<pre><code>root@vagrant:/sys/fs/cgroup$ ls memory/

cgroup.clone_children memory.limit_in_bytes

cgroup.event_control memory.max_usage_in_bytes

cgroup.procs memory.move_charge_at_immigrate</code></pre>
Some files within the Cgroup hierarchy are writable and allow you to manipulate the Cgroup&#8217;s behavior, while others contain information provided by the kernel to report on the their state.
For instance, `memory.limit_in_bytes` is a writable parameter that sets the memory limit for processes in the group, while `memory.max_usage_in_bytes` reports the highest memory usage within the group.
By default, the top-level memory directory contains information about all running processes. If you want to limit
memory usage for specific processes, you must create a new Cgroup and then assign those processes to it.
<h2>Creating Control groups</h2>
Creating a new Cgroup is as simple as creating a subdirectory within the resource-specific hierarchy. The kernel automatically populates this directory with files that represent parameters and statistics for the Cgroup. Here&#8217;s how you can create a new memory 
<pre><code>root@vagrant:/sys/fs/cgroup$ mkdir memory/liz</code></pre>
Now, you have a new Cgroup named &#8220;liz&#8221; under the memory hierarchy.
<h2>Setting Resource Limits</h2>
Resource limits are essential for preventing processes from consuming excessive resources. You can set memory limits for a Cgroup by modifying the `memory.limit_in_bytes` file within the Cgroup directory. For example:
<pre><code>
root@vagrant:/sys/fs/cgroup/memory/liz$ echo 100000 &gt; memory.limit_in_bytes</code></pre>
This command limits the memory usage of the &#8220;liz&#8221; Cgroup to 100,000 bytes. Processes within this  will not be allowed to exceed this limit.
<h2>Assigning Processes to Control groups</h2>
To assign a process to a specific Cgroup, you need to write the process ID (PID) into the `cgroup.procs` file within the its directory. Here&#8217;s how you can do it:
<pre><code>root@vagrant:/sys/fs/cgroup/memory/liz$ echo 29903 &gt; cgroup.procs</code></pre>
In this example, we assign the process with PID 29903 to the &#8220;liz&#8221; Cgroup. This process is now subject to the memory limits set for that Cgroup.
<h2>Control groups in Docker</h2>
Docker leverages Cgroups to control and limit resources for containers. When you start a Docker container, Docker automatically creates and manages Cgroups for that container. These  are organized under the &#8220;docker&#8221; hierarchy.
For instance, you can see the memory Cgroups for Docker containers like this:
root@vagrant:/sys/fs/cgroup$ ls */docker | grep docker
blkio/docker:
cpuacct/docker:
cpu,cpuacct/docker:
cpu/docker:
cpuset/docker:
devices/docker:
freezer/docker:
hugetlb/docker:
memory/docker:
net_cls/docker:
net_cls,net_prio/docker:
net_prio/docker:
perf_event/docker:
pids/docker:
systemd/docker:
Docker allows you to set resource limits for containers at runtime using flags like `&#8211;memory` and `&#8211;cpu`. These limits translate to constraints set within the Cgroups for that container.
<h2>Cgroups Version 2 (Cgroups v2)</h2>
It have evolved, and a version 2  was introduced in the Linux kernel in 2016. While it offers enhanced capabilities, it&#8217;s not as widely adopted as v1 in container runtimes like Docker at the time of writing.
One significant difference with v2 is that a process can&#8217;t join different groups for different controllers. Instead, it joins a single group that encompasses all controllers for that group.
<h2>Conclusion</h2>
These are a powerful resource management tool in the Linux ecosystem, playing a crucial role in controlling resource allocation and usage for processes and containers. Understanding how to create, manage, and set limits on essential for system administrators and anyone working with containers. These are a fundamental building block for achieving resource isolation and ensuring system stability, making them a valuable tool for optimizing system performance and security.
Do you like to read more educational content? Read our blogs at<a style="text-decoration: none;" href="https://www.cloudastra.co/blogs"> Cloudastra Technologies</a> or contact us for business enquiry at <a style="text-decoration: none;" href="https://www.cloudastra.co/contact">Cloudastra Contact Us</a>.
&nbsp;

Blog Details

A Deep Dive into Linux Cgroups for Resource Management