cgroups(7) Miscellaneous Information Manual cgroups(7) cgroups - Linux cgroup-, cgroups, Linux, , . cgroup- - , cgroupfs. cgroup, -- (, . .). cgroup -- , , cgroup. subsystem -- , cgroup-. , , cgroup-, , cgroup-. ( , ). cgroup- . , cgroup. (, ). , , , cgroup-, , . , , , cgroup cgroup-. Cgroups 1 2 The initial release of the cgroups implementation was in Linux 2.6.24. Over time, various cgroup controllers have been added to allow the management of various types of resources. However, the development of these controllers was largely uncoordinated, with the result that many inconsistencies arose between controllers and management of the cgroup hierarchies became rather complex. A longer description of these problems can be found in the kernel source file Documentation/admin-guide/cgroup-v2.rst (or Documentation/cgroup-v2.txt in Linux 4.17 and earlier). Because of the problems with the initial cgroups implementation (cgroups version 1), starting in Linux 3.10, work began on a new, orthogonal implementation to remedy these problems. Initially marked experimental, and hidden behind the -o __DEVEL__sane_behavior mount option, the new version (cgroups version 2) was eventually made official with the release of Linux 4.5. Differences between the two versions are described in the text below. The file cgroup.sane_behavior, present in cgroups v1, is a relic of this mount option. The file always reports "0" and is only retained for backward compatibility. cgroups v2 cgroups v1, ( ). , cgroups v2 , cgroups v1. , v1 v2 . , , , 2, 1, 2. , cgroups v1 cgroups v2. CGROUPS 1 cgroups v1 cgroup, . ( ) cgroups v1 cgroup, . . , cgroups . , /user/joe/1.session 1.session, cgroup joe, /user. cgroup , , cgroup. () cgroups v1 . ( , , ). cgroups v1 cgroup . cgroups v1 cgroups . , memory, . - cgroup cgroups v2, ( << >> ). v1 cgroups CONFIG_CGROUP. v1 , , . a v1, cgroup. tmpfs(5), /sys/fs/cgroup. , cpu : mount -t cgroup -o cpu none /sys/fs/cgroup/cpu . , cpu cpuacct : mount -t cgroup -o cpu,cpuacct none /sys/fs/cgroup/cpu,cpuacct cgroup . cgroup /foo1 /foo2/foo3 . v1 : mount -t cgroup -o all cgroup /sys/fs/cgroup ( -o all , , ) It is not possible to mount the same controller against multiple cgroup hierarchies. For example, it is not possible to mount both the cpu and cpuacct controllers against one hierarchy, and to mount the cpu controller alone against another hierarchy. It is possible to create multiple mount with exactly the same set of comounted controllers. However, in this case all that results is multiple mount points providing a view of the same hierarchy. Note that on many systems, the v1 controllers are automatically mounted under /sys/fs/cgroup; in particular, systemd(1) automatically creates such mounts. v1 cgroup umount(8) : umount /sys/fs/cgroup/pids But note well: a cgroup filesystem is unmounted only if it is not busy, that is, it has no child cgroups. If this is not the case, then the only effect of the umount(8) is to make the mount invisible. Thus, to ensure that the mount is really removed, one must first remove all child cgroups, which in turn can be done only after all member processes have been moved from those cgroups to the root cgroup. cgroups 1 cgroups 1 ( ). , cgroups CONFIG_CGROUPS. cpu ( Linux 2.6.24; CONFIG_CGROUP_SCHED) Cgroups can be guaranteed a minimum number of "CPU shares" when a system is busy. This does not limit a cgroup's CPU usage if the CPUs are not busy. For further information, see Documentation/scheduler/sched-design-CFS.rst (or Documentation/scheduler/sched-design-CFS.txt in Linux 5.2 and earlier). In Linux 3.2, this controller was extended to provide CPU "bandwidth" control. If the kernel is configured with CONFIG_CFS_BANDWIDTH, then within each scheduling period (defined via a file in the cgroup directory), it is possible to define an upper limit on the CPU time allocated to the processes in a cgroup. This upper limit applies even if there is no other competition for the CPU. Further information can be found in the kernel source file Documentation/scheduler/sched-bwc.rst (or Documentation/scheduler/sched-bwc.txt in Linux 5.2 and earlier). cpuacct ( Linux 2.6.24; CONFIG_CGROUP_CPUACCT) . Further information can be found in the kernel source file Documentation/admin-guide/cgroup-v1/cpuacct.rst (or Documentation/cgroup-v1/cpuacct.txt in Linux 5.2 and earlier). cpuset ( Linux 2.6.24; CONFIG_CPUSETS) cgroup cgroup NUMA. Further information can be found in the kernel source file Documentation/admin-guide/cgroup-v1/cpusets.rst (or Documentation/cgroup-v1/cpusets.txt in Linux 5.2 and earlier). memory ( Linux 2.6.25; CONFIG_MEMCG) , , cgroups. Further information can be found in the kernel source file Documentation/admin-guide/cgroup-v1/memory.rst (or Documentation/cgroup-v1/memory.txt in Linux 5.2 and earlier). devices ( Linux 2.6.26; CONFIG_CGROUP_DEVICE) This supports controlling which processes may create (mknod) devices as well as open them for reading or writing. The policies may be specified as allow-lists and deny-lists. Hierarchy is enforced, so new rules must not violate existing rules for the target or ancestor cgroups. Further information can be found in the kernel source file Documentation/admin-guide/cgroup-v1/devices.rst (or Documentation/cgroup-v1/devices.txt in Linux 5.2 and earlier). freezer ( Linux 2.6.28; CONFIG_CGROUP_FREEZER) freezer cgroup cgroup. cgroup /A , , /A/B . Further information can be found in the kernel source file Documentation/admin-guide/cgroup-v1/freezer-subsystem.rst (or Documentation/cgroup-v1/freezer-subsystem.txt in Linux 5.2 and earlier). net_cls ( Linux 2.6.29; CONFIG_CGROUP_NET_CLASSID) classid, cgroup, , cgroup. classid , tc(8). , cgroup, cgroup. Further information can be found in the kernel source file Documentation/admin-guide/cgroup-v1/net_cls.rst (or Documentation/cgroup-v1/net_cls.txt in Linux 5.2 and earlier). blkio ( Linux 2.6.33; CONFIG_BLK_CGROUP) blkio cgroup , - (throttling) . . : , CFQ. CFQ. : , . Further information can be found in the kernel source file Documentation/admin-guide/cgroup-v1/blkio-controller.rst (or Documentation/cgroup-v1/blkio-controller.txt in Linux 5.2 and earlier). perf_event ( Linux 2.6.39; CONFIG_CGROUP_PERF) perf , cgroup. Further information can be found in the kernel source files net_prio ( Linux 3.3; CONFIG_CGROUP_NET_PRIO) cgroups . Further information can be found in the kernel source file Documentation/admin-guide/cgroup-v1/net_prio.rst (or Documentation/cgroup-v1/net_prio.txt in Linux 5.2 and earlier). hugetlb ( Linux 3.5; CONFIG_CGROUP_HUGETLB) cgroups . Further information can be found in the kernel source file Documentation/admin-guide/cgroup-v1/hugetlb.rst (or Documentation/cgroup-v1/hugetlb.txt in Linux 5.2 and earlier). pids ( Linux 4.3; CONFIG_CGROUP_PIDS) , cgroup ( ). Further information can be found in the kernel source file Documentation/admin-guide/cgroup-v1/pids.rst (or Documentation/cgroup-v1/pids.txt in Linux 5.2 and earlier). rdma ( Linux 4.11; CONFIG_CGROUP_RDMA) RDMA RDMA/IB cgroup. Further information can be found in the kernel source file Documentation/admin-guide/cgroup-v1/rdma.rst (or Documentation/cgroup-v1/rdma.txt in Linux 5.2 and earlier). cgroups , cgroup cgroup, <>, . cgroup cgroup: mkdir /sys/fs/cgroup/cpu/cg1 cgroup. cgroup PID cgroup cgroup.procs: echo $$ > /sys/fs/cgroup/cpu/cg1/cgroup.procs PID. cgroup.procs 0 cgroup . PID cgroup.procs cgroup . cgroup. PID cgroup.procs cgroup, . , cgroup, cgroup.procs. PID . PID (, PID ). cgroups v1 cgroup ID (. ., ID , clone(2) gettid(2)) tasks cgroup. , , cgroup. cgroups cgroup cgroups ( ). , . , cgroup . cgroups v1 , cgroup, . Cgroup , cgroup . cgroup, release_agent, , , cgroup . release_agent ( cgroup) cgroup. release_agent cgroup , , . release_agent , . release_agent cgroup: mount -o release_agent= release_agent cgroup, notify_on_release , cgroup. 0, release_agent . 1, release_agent . 0 cgroup. , cgroup, cgroup. cgroup v1 cgroups v1 cgroup, : mount -t cgroup -o none,name=-_ none /some/mount/point ; . ( ). cgroup name=systemd, systemd(1) . Linux 5.0, cgroup_no_v1 ( ) cgroup v1 : cgroup_no_v1=named. CGROUPS 2 cgroup v2 . () v1 v2, v1 v2. cgroups v2, , . o Cgroups v2 . o <<>> . cgroup, ( cgroup, cgroup). , . o cgroup- cgroup.controllers cgroup.subtree_control. o tasks. cgroup.clone_children, cpuset. o cgroup cgroup.events. For more changes, see the Documentation/admin-guide/cgroup-v2.rst file in the kernel source (or Documentation/cgroup-v2.txt in Linux 4.17 and earlier). Linux 4.14 << >> ( ). cgroups v2 cgroups v1, . , , . cgroups v2, . , ( ) cgroup v2 : mount -t cgroup2 none /mnt/cgroup2 cgroup v2 , cgroup v1. , , v1 v2. , v1 ( ), v2. systemd(1) v1, v1. cgroup_no_v1= ; all v1 ( systemd(1) ). , systemd(1) cgroup2 /sys/fs/cgroup/unified . Cgroups v2 mount options The following options (mount -o) can be specified when mounting the group v2 filesystem: nsdelegate ( Linux 4.15) Treat cgroup namespaces as delegation boundaries. For details, see below. memory_localevents (since Linux 5.2) The memory.events should show statistics only for the cgroup itself, and not for any descendant cgroups. This was the behavior before Linux 5.2. Starting in Linux 5.2, the default behavior is to include statistics for descendant cgroups in memory.events, and this mount option can be used to revert to the legacy behavior. This option is system wide and can be set on mount or modified through remount only from the initial mount namespace; it is silently ignored in noninitial namespaces. cgroups v2 The following controllers, documented in the kernel source file Documentation/admin-guide/cgroup-v2.rst (or Documentation/cgroup-v2.txt in Linux 4.17 and earlier), are supported in cgroups version 2: cpu ( Linux 4.15) cpu cpuacct 1. cpuset (since Linux 5.0) This is the successor of the version 1 cpuset controller. freezer (since Linux 5.2) This is the successor of the version 1 freezer controller. hugetlb (since Linux 5.6) This is the successor of the version 1 hugetlb controller. io ( Linux 4.5) blkio 1. memory ( Linux 4.5) memory 1. perf_event ( Linux 4.11) perf_event 1. pids ( Linux 4.5) pids 1. rdma ( Linux 4.11) rdma 1. There is no direct equivalent of the net_cls and net_prio controllers from cgroups version 1. Instead, support has been added to iptables(8) to allow eBPF filters that hook on cgroup v2 pathnames to make decisions about network traffic on a per-cgroup basis. The v2 devices controller provides no interface files; instead, device control is gated by attaching an eBPF (BPF_CGROUP_DEVICE) program to a v2 cgroup. cgroups v2 cgroup v2 : cgroup.controllers , cgroup. cgroup.subtree_control cgroup. cgroup.subtree_control , () cgroup. cgroup.controllers cgroup. ; <<+>> ( ) <<->> ( ), : echo '+pids -memory' > x/y/cgroup.subtree_control , cgroup.controllers, ENOENT cgroup.subtree_control. cgroup.subtree_control cgroup.controllers, , cgroup, cgroup. cgroup cgroup.subtree_control , cgroup. ( pids), cgroup.subtree_control cgroup, ( pids.max) cgroup cgroup. Cgroups v2 "no internal processes" rule Cgroups v2 << >>. , , cgroup, (cgroup, cgroup). , cgroup A cgroup- A. , cgroup /cg1/cg2, /cg1/cg2, /cg1. cgroups v1 /cg1 cgroup-. cgroups v2 -- leaf cgroup, cgroup-. , /cg1 /cg1/leaf. /cg1/leaf /cg1. The "no internal processes" rule is in fact more subtle than stated above. More precisely, the rule is that a (nonroot) cgroup can't both (1) have member processes, and (2) distribute resources into child cgroups--that is, have a nonempty cgroup.subtree_control file. Thus, it is possible for a cgroup to have both member processes and child cgroups, but before controllers can be enabled for that cgroup, the member processes must be moved out of the cgroup (e.g., perhaps into the child cgroups). Linux 4.14 << >> ( ) << >> . cgroup.events cgroups v2 Each nonroot cgroup in the v2 hierarchy contains a read-only file, cgroup.events, whose contents are key-value pairs (delimited by newline characters, with the key and value separated by spaces) providing state information about the cgroup: $ cat mygrp/cgroup.events populated 1 frozen 0 The following keys may appear in this file: populated The value of this key is either 1, if this cgroup or any of its descendants has member processes, or otherwise 0. frozen (since Linux 5.2) The value of this key is 1 if this cgroup is currently frozen, or 0 if it is not. The cgroup.events file can be monitored, in order to receive notification when the value of one of its keys changes. Such monitoring can be done using inotify(7), which notifies changes as IN_MODIFY events, or poll(2), which notifies changes by returning the POLLPRI and POLLERR bits in the revents field. Cgroup v2 release notification Cgroups v2 provides a new mechanism for obtaining notification when a cgroup becomes empty. The cgroups v1 release_agent and notify_on_release files are removed, and replaced by the populated key in the cgroup.events file. This key either has the value 0, meaning that the cgroup (and its descendants) contain no (nonzombie) member processes, or 1, meaning that the cgroup (or one of its descendants) contains member processes. The cgroups v2 release-notification mechanism offers the following advantages over the cgroups v1 release_agent mechanism: o It allows for cheaper notification, since a single process can monitor multiple cgroup.events files (using the techniques described earlier). By contrast, the cgroups v1 mechanism requires the expense of creating a process for each notification. o Notification for different cgroup subhierarchies can be delegated to different processes. By contrast, the cgroups v1 mechanism allows only one release agent for an entire hierarchy. cgroup.stat cgroups v2 cgroup v2 cgroup.stat, ( Linux 4.14), -. : nr_descendants (. ., ) cgroups -- cgroup. nr_dying_descendants cgroups -- cgroup. cgroups . ( ), cgroup. , cgroups . cgroup, cgroup . cgroups cgroup v2 , cgroup cgroup: cgroup.max.depth ( Linux 4.14) cgroup. 0 cgroup. , , (mkdir(2) EAGAIN). Writing the string "max" to this file means that no limit is imposed. The default value in this file is "max". cgroup.max.descendants ( Linux 4.14) cgroup, cgroup. , , (mkdir(2) EAGAIN). Writing the string "max" to this file means that no limit is imposed. The default value in this file is "max". CGROUPS: cgroups, cgroup . Cgroups v1 cgroup, v2 ( ). cgroups v2 . , cgroups v2, cgroups v1. . (.., ), cgroup. , , cgroup, . , , , , -. , () /dlgt_grp - cgroups cgroup, - : /dlgt_grp , cgroups, ( , ), . /dlgt_grp/cgroup.procs , . /dlgt_grp/cgroup.subtree_control ( cgroups v2) , ( /dlgt_grp/cgroup.controllers), ( ). /dlgt_grp/cgroup.threads ( cgroups v2) ( << >> ). ID ( , , , , cgroup ID cgroup.threads). cgroups v1 tasks. (, pids.max, memory.high) dlgt_grp. , , , . cgroups v2 /sys/kernel/cgroup/delegate . cgroups ( cgroup ) cgroup . dlgt_grp/cgroup.subtree_control , , . cgroups v2: nsdelegate cgroup Linux 4.13 cgroup cgroups v2. cgroup v2 nsdelegate. , cgroup v2 , nsdelegate : mount -t cgroup2 -o remount,nsdelegate \ none /sys/fs/cgroup/unified cgroup . cgroup : o EPERM. cgroup - cgroup ( cgroup.procs cgroup.subtree_control) . o ( ENOENT). cgroup - ( ) cgroup . cgroup cgroup . , , cgroup, , cecilia, , . , cecilia (, , cecilia). , cgroup namespace , cecilia, : o (, cgroup; cgroup ). o , cgroup - . nsdelegate . nsdelegate , ; . : systemd(1) cgroup v2. nsdelegate , : cgroup_no_v1=all systemd.legacy_systemd_cgroup_controller cgroups v1 (. ., v2) systemd(1) cgroup v2, v2 . cgroup , , . (. ., ) PID <<>> cgroup.procs , : o cgroup.procs cgroup. o cgroup.procs cgroups . , , cgroup . cgroups v1, v1 , v2 (, cgroups v1 , , ). o cgroup v2 nsdelegate, cgroup cgroup. o cgroups v1: UID (. ., ) ID set-user-ID . Linux 4.11 cgroups v2 ( , cgroups v1, , cgroups v2). : , ; (, ) . CGROUPS 2 , cgroups v2, cgroups v1: o : cgroup. o : cgroup - cgroup. - , cgroups v1. , cgroups v1 ( memory: , memory cgroup). cgroups v2 , , cpu, . , Linux 4.14 cgroups v2 . : o , cgroup ( ). o , cgroup . o << >>, cgroup cgroup. , cgroup , cgroup.type, , , <<>> cgroup. : domain cgroup v2, . cgroup, ( ) cgroup. cgroup , , cgroup cgroups v2. threaded cgroup . cgroup , cgroup . domain threaded cgroup, . cgroup << >>. domain invalid This is a cgroup inside a threaded subtree that is in an "invalid" state. Processes can't be added to the cgroup, and controllers can't be enabled for the cgroup. The only thing that can be done with this cgroup (other than deleting it) is to convert it to a threaded cgroup by writing the string "threaded" to the cgroup.type file. <<>> ( , cgroup threaded) . cgroups v2 : o : ; cgroup . Linux 4.19 : cpu, perf_event pids. o : . . . . : (1) We write the string "threaded" to the cgroup.type file of a cgroup y/z that currently has the type domain. This has the following effects: o cgroup y/z threaded. o cgroup, y, domain threaded. cgroup ( << >>). o cgroup y, threaded domain invalid ( ). cgroup y domain invalid. (2) We write the string "threaded" to each of the domain invalid cgroups under y, in order to convert them to the type threaded. As a consequence of this step, all threads under the threaded root now have the type threaded and the threaded subtree is now fully usable. The requirement to write "threaded" to each of these cgroups is somewhat cumbersome, but allows for possible future extensions to the thread-mode model. : (1) In an existing cgroup, z, that currently has the type domain, we (1.1) enable one or more threaded controllers and (1.2) make a process a member of z. (These two steps can be done in either order.) This has the following consequences: o z domain threaded. o All of the descendant cgroups of z that were not already of type threaded are converted to type domain invalid. (2) As before, we make the threaded subtree usable by writing the string "threaded" to each of the domain invalid cgroups under z, in order to convert them to the type threaded. , cgroup cgroup threaded ( domain invalid). cgroup cgroup domain cgroup threaded cgroup domain. , threaded; , , cgroup. PID cgroup.procs cgroup . cgroup, -- . ID ( gettid(2)) cgroup.threads cgroup . . cgroup.procs, cgroup.threads : o cgroup.threads cgroup. o cgroup.procs cgroups ( , cgroup ). o cgroup ( ID cgroup.threads cgroup domain EOPNOTSUPP). cgroup.threads cgroup ( cgroup c domain) , . ID , , . cgroup.procs PID , . cgroup.procs cgroup . ; cgroup . : , cgroup . << >> : cgroup - ( ) cgroup. cgroup.type cgroup.type : o Only the string "threaded" may be written. In other words, the only explicit transition that is possible is to convert a domain cgroup to type threaded. o The effect of writing "threaded" depends on the current value in cgroup.type, as follows: o domain domain threaded: ( cgroup) , ; o domain invalid: cgroup ( ) (. ., threaded); o threaded: (<< >>). o cgroup.type, domain invalid. , cgroup threaded . cgroup x : o - cgroup x ( cgroup x -). o x cgroup.subtree_control. If any of the above constraints is violated, then an attempt to write "threaded" to a cgroup.type file fails with the error ENOTSUP. The "domain threaded" cgroup type , , cgroup domain threaded : o The string "threaded" is written to a child cgroup. o cgroup cgroup. A domain threaded cgroup, x, can revert to the type domain if the above conditions no longer hold true--that is, if all threaded child cgroups of x are removed and either x no longer has threaded controllers enabled or no longer has member processes. cgroup x domain threaded domain: o x domain invalid, , domain. o cgroup, domain threaded. cgroup The root cgroup of the v2 hierarchy is treated exceptionally: it can be the parent of both domain and threaded cgroups. If the string "threaded" is written to the cgroup.type file of one of the children of the root cgroup, then o cgroup threaded. o cgroup, , domain invalid. , cgroup, domain threaded ( , cgroup cgroup, threaded). cgroup cgroup , cpu, , , () cgroup. The cgroups v2 "cpu" controller and realtime threads As at Linux 4.19, the cgroups v2 cpu controller does not support control of realtime threads (specifically threads scheduled under any of the policies SCHED_FIFO, SCHED_RR, described SCHED_DEADLINE; see sched(7)). Therefore, the cpu controller can be enabled in the root cgroup only if all realtime threads are in the root cgroup. (If there are realtime threads in nonroot cgroups, then a write(2) of the string "+cpu" to the cgroup.subtree_control file fails with the error EINVAL.) systemd(1) cgroups v2. cgroup, cpu. mount(2): EBUSY cgroup 1 name= ( ) ( all). , fork(2), cgroup. cgroup execve(2). The clone3(2) CLONE_INTO_CGROUP flag can be used to create a child process that begins its life in a different version 2 cgroup from the parent process. /proc /proc/cgroups ( Linux 2.6.24) , . ( ): #subsys_name hierarchy num_cgroups enabled cpuset 4 1 1 cpu 8 1 1 cpuacct 8 1 1 blkio 6 1 1 memory 3 1 1 devices 10 84 1 freezer 7 1 1 net_cls 9 1 1 perf_event 5 1 1 net_prio 9 1 1 hugetlb 0 1 0 pids 2 1 1 , : [1] . [2] ID cgroup, . cgroups v1, ID . 0, : o cgroups v1; o cgroups v2; o ( ). [3] , . [4] 1, , 0, ( cgroup_disable ). /proc/pid/cgroup ( Linux 2.6.24) , PID. cgroups 1 2. cgroup, , , : ID : : cgroup : 5:cpuacct,cpu,cpuset:/daemons , , : [1] cgroups 1 ID , ID /proc/cgroups. cgroups 2 0. [2] cgroups 1 , , . cgroups 2 . [3] , . . /sys/kernel/cgroup /sys/kernel/cgroup/delegate ( Linux 4.15) cgroups v2 ( ), (. ., ID ). , , , . Linux 4.15 : $ cat /sys/kernel/cgroup/delegate cgroup.procs cgroup.subtree_control cgroup.threads /sys/kernel/cgroup/features ( Linux 4.15) cgroups v2, , , . , , . : $ cat /sys/kernel/cgroup/features nsdelegate memory_localevents : memory_localevents (since Linux 5.2) The kernel supports the memory_localevents mount option. nsdelegate ( Linux 4.15) nsdelegate . memory_recursiveprot (since Linux 5.7) The kernel supports the memory_recursiveprot mount option. prlimit(1), systemd(1), systemd-cgls(1), systemd-cgtop(1), clone(2), ioprio_set(2), perf_event_open(2), setrlimit(2), cgroup_namespaces(7), cpuset(7), namespaces(7), sched(7), user_namespaces(7) The kernel source file Documentation/admin-guide/cgroup-v2.rst. () Azamat Hackimov , Dmitriy S. Seregin , Dmitry Bolkhovskikh , Katrin Kutepova , Yuri Kozlov ; GNU (GNU General Public License - GPL, 3 ) , - . - , , () () () <>. Linux 6.9.1 15 2024 . cgroups(7)