Comparison
cgroupsvsResource limit
cgroups
the process is capped at half a CPU and a gigabyte by the kernel, and it has no idea — it still reports the host's numbers.
The kernel feature that accounts for and limits a group of processes' CPU, memory, IO and PIDs. It is the half of containerisation that does resource control, and it is what a memory limit and a CPU limit are actually implemented as. Its most expensive side effect is that many runtimes read the host's CPU count rather than the cgroup's, so thread pools and garbage collectors size themselves for a machine the container cannot use.
Full entry →Resource limit
the container went one byte over its memory ceiling and the kernel killed it outright, mid-request.
The hard ceiling a container may consume, enforced by the kernel rather than by the scheduler. The two resources behave completely differently at the ceiling: CPU is throttled, so the workload gets slow, and memory is not compressible, so the process is killed. That asymmetry is why a CPU limit shows up as mysterious latency and a memory limit shows up as a restart loop.
Full entry →