Comparison
cgroupsvsLinux namespaces
cgroups
the process is capped at half a CPU and a gigabyte by the kernel, and it has no idea — it still reports the host's numbers.
The kernel feature that accounts for and limits a group of processes' CPU, memory, IO and PIDs. It is the half of containerisation that does resource control, and it is what a memory limit and a CPU limit are actually implemented as. Its most expensive side effect is that many runtimes read the host's CPU count rather than the cgroup's, so thread pools and garbage collectors size themselves for a machine the container cannot use.
Full entry →Linux namespaces
the container sees PID 1, its own network interfaces and its own mount tree, all of which are a partial view of the host's.
The kernel feature that gives a process a private view of a global resource — process IDs, mounts, network stack, hostname, users. It is the other half of containerisation: namespaces do the isolation, cgroups do the limits. Understanding that both are per-kernel features is what makes it obvious why a container is not a security boundary of the same class as a virtual machine.
Full entry →