In the load-average lesson you saw that Docker limits a container's
CPU/RAM. But where do those limits live? The answer is cgroups
v2, a hierarchical virtual filesystem under /sys/fs/cgroup.
This is a read-only tour. You will see where the current process sits,
which limits apply to it, and how the kernel enforces them. Changing
limits from inside a container is usually not allowed (it needs
SYS_ADMIN plus a cgroup namespace), but you can always read them,
and that is important diagnostics in production.