Backend question · Docker › Images, containers & the runtime

`docker run --memory=512m --cpus=1 myapp` limits the container's resources. Which kernel feature enforces those limits?

Control groups (cgroups)

cgroups (control groups) measure and limit CPU, memory and I/O for a group of processes. "Namespaces" is the tempting answer, but namespaces control what a process can see (PIDs, network, mounts). They do not control how much it can use.

docker container run (https://docs.docker.com/reference/cli/docker/container/run/)docs.docker.com
Docker overview (https://docs.docker.com/get-started/docker-overview/)docs.docker.com