cgroups and namespaces in Linux: the basis of containers

cgroups and namespaces are two kernel mechanisms behind containers: cgroups limit resources, namespaces isolate processes.

Common cases

systemd-cgls               # the cgroup tree with processes
systemctl status nginx     # a service's cgroup shows at the bottom
cat /sys/fs/cgroup/...     # cgroup limits and counters
lsns                       # list the namespaces on the system
ls -l /proc/$$/ns          # which namespaces the shell is in

How it works: limits plus isolation

These are two independent mechanisms, and together they make a container. cgroups (control groups) handle HOW MUCH: how much CPU, memory and I/O a group of processes gets - so one service cannot eat the whole machine. namespaces handle WHAT IS VISIBLE: a process in its own namespace sees only its own processes, its own network, its own filesystem, as if it were alone on the machine. Docker and systemd are not 'magic': they just set up the kernel's cgroups and namespaces. That is why inside a container ps shows only its processes.

In the book

This topic is covered in full in the chapter Kernel internals and tuning.

See also

The /proc filesystem, Viewing processes, Services: systemctl.