A note on cgroups

Linux cgroups are a mechanism used to control the number of processes that can be spawned and so prevent a system from suffering severe performance loss or worse, crashing.

By using cgroups, we can set a limit to the number of processes that can be spawned through the fork() and clone() operations. Once a limit is hit, it's not possible to generate any further processes under the cgroup. Additionally, cgroups support the ability to set CPU and memory limits. You can read about their comprehensive list of options at https://www.man7.org/linux/man-pages/man7/cgroups.7.html

Using this feature enables you to have more granular control over the system resources that your container is using. In an unfortunate event where a container is compromised, preventing it from over-consuming system resources is a useful mechanism to limit the damage until you can remediate the problem.

Having looked at how Docker Engine and containerd use best practices from Linux...