Namespaces isolate views; cgroups account and limit resources
Container là processes trên host kernel với namespace/cgroup/security configuration—not a lightweight VM.
Containers
Namespaces
PID, mount, network, IPC, UTS, user, cgroup and time namespaces isolate resource views. A process belongs to one namespace of each type and can hold namespace FDs. User namespace remaps IDs but filesystem/capability interactions require care.
PID namespace and PID 1
First process is namespace init, reaps orphans and has special default signal behavior. Shell wrapper may not forward signals; exec-form application or minimal init/subreaper. Host PID differs; nsenter/proc mapping needed for diagnostics.
cgroup v2
Unified hierarchy controllers: cpu, memory, io, pids, cpuset and more. memory.current/max/high/events, cpu.max/weight/stat, pids.current/max and PSI. Limits hierarchical; charge/reclaim/kill occurs in cgroup scope and shared kernel resources still exist.
OOM and memory
memory.high throttles/reclaims, memory.max hard limit can trigger cgroup OOM; swap controls separate. OOM kill may select one/all depending policy/runtime. Exit 137 only suggests SIGKILL; inspect cgroup events/container status/kernel logs.
Security and resources
Capabilities, seccomp, LSM, read-only mounts and user IDs constrain syscalls/access; namespaces are not complete security alone. PID/FD/thread bombs need pids/ulimits; CPU quota can create latency despite reported cores.
Operations
Set requests/reservations for scheduling and limits for guardrails based profiling; too-low memory causes reclaim/OOM, too-high hides capacity. Runtime/JDK versions must be container-aware. Debug both namespace-local and host/cgroup views.