The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Control groups, usually called cgroups, are a Linux kernel mechanism for placing processes in a hierarchy and controlling or measuring resources such as CPU and memory. A parent cgroup can impose limits on every descendant, while resource controllers implement the behavior for particular resources. This makes cgroups a foundation for service managers, containers and workload accounting—but not a complete security or isolation boundary.
The mental model: a process tree with resource policy
A cgroup is a kernel-managed group of processes. Groups form a hierarchy: a parent contains child cgroups, and processes can be attached at different points in that tree. Controllers apply resource policy along the hierarchy, so a restriction imposed by an ancestor also affects its descendants. A child cannot use its own settings to bypass a limit enforced above it.
The cgroup core handles membership and hierarchy. Separate controllers provide resource-specific behavior, such as CPU allocation, memory limits, process freezing, and accounting. The available controllers depend on the running kernel and how the host has configured its hierarchy; there is no universal list that every Linux system exposes.
“cgroup is a mechanism to organize processes hierarchically and distribute system resources along the hierarchy in a controlled and configurable manner.”
PerformancePC Slower Than It Used to Be?DriversCrashes, No Sound, or Screen Glitches?PerformanceWindows Errors? Fix Them Before They SpreadSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.#1 Best Overall
— Tejun Heo, Linux kernel Control Group v2 documentation
Why cgroups matter for services and workloads
Without cgroups, a busy process can compete with unrelated work for the same CPU time or memory. Grouping processes lets an administrator apply policy to a service or workload as a unit instead of configuring each process separately.
- Resource distribution: CPU or other controller policies can give workloads proportional access or enforce ceilings.
- Resource limits: A group can be constrained so that one service cannot consume all available memory or CPU.
- Accounting and monitoring: Usage can be observed for a group rather than inferred from individual process names.
- Lifecycle operations: Controllers can support operations such as freezing and resuming all processes in a group.
These functions organize and control resource use. Cgroups do not, by themselves, provide every form of process, filesystem, network or privilege isolation, and should not be treated as a complete security boundary.
cgroups v1 and v2: the important differences
Linux has two cgroup interface generations. The choice affects hierarchy layout, controller availability and which management software can configure the tree.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Axis | cgroups v1 | cgroups v2 |
|---|---|---|
| Hierarchy model | Multiple hierarchies can be mounted, with controllers attached to different hierarchies. | One unified hierarchy is used for the cgroup interface. |
| Interface organization | Controller-specific hierarchies expose their own directory and file arrangements. | A common hierarchy and standardized control files coordinate controller use. |
| Controller set | Includes controllers that may not exist in v2. | Implements a subset of the v1 controllers; the exact set depends on the kernel. |
| Compatibility | Still relevant for software and hosts that require v1. | Designed to replace v1 over time, but migration is not identical on every distribution. |
| Configuration owner | May be mounted and managed by several tools. | Often managed by systemd on a systemd host, subject to that host’s configuration. |
The Linux man-pages describe the original cgroup implementation as arriving in Linux 2.6.24, v2 work beginning in Linux 3.10, and v2 becoming official with Linux 4.5. Those milestones describe kernel history, not a promise that a current distribution enables a particular mode by default. See Linux man-pages cgroups(7), version 6.17 (2026-02-08) and the historical v1 documentation.
How a cgroup v2 hierarchy is built
Discover controllers instead of assuming them
In v2, supported controllers that are not attached to a v1 hierarchy are listed in a cgroup’s cgroup.controllers file. A controller must be available in the running kernel and exposed at the relevant point in the hierarchy before it can be enabled. Read the file on the target host rather than relying on a distribution-independent list.
Enable controllers for child cgroups
The parent controls which controllers its children may use through cgroup.subtree_control. Enabling is top-down: a controller must be enabled at each required parent level before a lower child can use it. For example, a privileged administrator might inspect and then enable a controller with commands conceptually like:
cat /sys/fs/cgroup/cgroup.controllers
cat /sys/fs/cgroup/cgroup.subtree_control
echo +cpu +memory > /sys/fs/cgroup/cgroup.subtree_controlThe exact path and permitted controller names depend on the mounted hierarchy and kernel configuration. Do not copy the example blindly onto a host where those controllers are absent or where another manager owns the files.
Free tools Windows power users keep installed
One-click scans. No signup required.
Move processes and respect the domain rule
Processes are assigned by writing a PID to a cgroup’s cgroup.procs file. In a non-root domain cgroup, domain controllers generally can be enabled for child cgroups only when that cgroup has no processes of its own. A common setup sequence is therefore to create child cgroups, move processes into the appropriate leaves, and then enable domain controllers for those children. The kernel’s Control Group v2 documentation defines the precise rules and exceptions.
Delegation: handing over a subtree without handing over the host
Delegation lets a less-privileged user, service or cgroup namespace manage a designated subtree. The delegatee can create children and adjust controls allowed within that subtree, but ancestor limits still apply. Delegation is a controlled handoff, not permission to escape the parent hierarchy.
The parent manager must protect its own resource-control interface files. In particular, the kernel guidance says a delegatee should not be allowed to write the resource-control files owned by the parent. A safe design gives the delegatee ownership of the intended subtree while retaining the parent’s control over limits and hierarchy boundaries.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How systemd uses cgroups
On a systemd-managed host, systemd PID 1 owns the main cgroup tree and maps units—services, slices, scopes and related objects—to cgroups. You normally configure resources through unit properties instead of writing kernel files directly. This keeps service lifecycle and resource policy under one manager.
Best Value
- New
- Mint Condition
- Dispatch same day for order received before 12 noon
- Guaranteed packaging
- No quibbles returns
Unit-level settings
The systemd resource-control interface exposes settings that translate to controller files. For example, CPUWeight= controls proportional CPU weight in the unified hierarchy’s cpu.weight; the current manual documents a range of 1 to 10000, with a kernel default of 100. The valid behavior still depends on the systemd and kernel versions installed on the host. Consult systemd.resource-control(5) for the version running on your system.
Single-writer ownership and delegation
Each individual cgroup should have a single writer. If a service needs to create and manage subgroups beneath its systemd unit, explicitly enable delegation, commonly with the unit property Delegate=yes. Without delegation, a service that writes the same subtree systemd manages can conflict with systemd’s ownership model. The systemd project explains this interface and delegation contract in The New Control Group Interfaces.
A practical checklist for examining a host
- Identify the hierarchy mode. Inspect the mounted cgroup filesystem and determine whether the host is using a unified v2 hierarchy, v1 hierarchies, or a compatibility arrangement.
- Find the manager. On a systemd host, check the relevant unit and slice before editing files directly; systemd may be the owner.
- Read available controllers. Examine
cgroup.controllersat the parent where you intend to enable policy. - Check parent policy. Review ancestor limits and
cgroup.subtree_control; descendants cannot override restrictive settings above them. - Plan process placement. Create the desired child groups and move processes using the manager that owns the hierarchy.
- Delegate only when needed. If another service must manage a subtree, grant explicit delegation and keep parent-owned control files protected.
What cgroups do not answer by themselves
A cgroup tells the kernel which processes share resource policy, but it does not define the whole isolation design. Namespaces, filesystem permissions, Linux capabilities, seccomp, networking controls and other mechanisms may be needed for a container or hardened service. The appropriate combination depends on the workload and threat model; cgroups should be understood as the resource-management layer.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
