How the Linux Kernel Actually Enforces Container Resource Limits

This video takes you deep into the mechanisms behind container resource enforcement.

We'll explore two architectures - cgroup v1 and v2 - understand why v2 exists and why the industry is migrating to it, and most importantly, learn how Kubernetes translates your pod resource specs into actual kernel-level controls.

What You'll Learn:
- How cgroups integrate with the Linux kernel scheduler and memory management
- The architectural difference between v1 (multiple hierarchies) and v2 (unified hierarchy)
- CPU controller mechanisms: proportional shares vs hard limits, and why throttling destroys tail latency
- Memory controller and OOM handling: how mem_cgroup_charge() enforces limits and triggers kills
- Pressure Stall Information (PSI): v2's predictive monitoring that shows resource pressure before failure
- Hands-on demos: CPU throttling with cpu.max, triggering OOM kills, reading throttle statistics
- Kubernetes QoS classes: how Guaranteed, Burstable, and BestEffort map directly to cgroup configurations and OOM priorities
- Production insights: when to set limits vs requests, migration strategies, and security considerations

Hands-On Demos:
- Creating cgroups and enforcing CPU limits - watching kernel throttle a process in real-time
- Triggering memory OOM kills and inspecting kernel logs
- Kubernetes QoS mapping with minikube - tracing pod specs to actual cgroup files and OOM scores

Prerequisites:
- Ubuntu 22.04 (for local cgroup demos) or access to a Linux VM
minikube on macOS for Kubernetes demo
- Basic familiarity with containers and Kubernetes concepts
Tools: stress-ng, systemd-cgtop, kubectl

Why This Matters:
When you debug resource issues in production, kubectl describe only tells you what Kubernetes thinks happened. The truth lives in the kernel. This video teaches you to inspect cgroup files, check throttling statistics, read PSI metrics, and understand what the kernel actually enforced.

You'll stop debugging containers and start debugging kernel mechanisms.
By the end, you'll understand the complete chain: YAML resource spec → kubelet → cgroup control files → kernel enforcement → your application's behavior.

Видео How the Linux Kernel Actually Enforces Container Resource Limits канала MattOps | DevOps & SRE