Redesigns of v1 Redesign of cgroups started in 2013, with additional changes brought by versions 3.15 and 3.16 of the Linux kernel. The following changes concern the kernel before 4.5/4.6, i.e. when cgroups-v2 were added. In other words they describe how cgroups-v1 had been changed, though most of them have also been inherited into v2 (after all, v1 and v2 share the same codebase).
Namespace isolation While not technically part of the cgroups work, a related feature of the Linux kernel is
namespace isolation, where groups of processes are separated such that they cannot "see" resources in other groups. For example, a PID namespace provides a separate enumeration of
process identifiers within each namespace. Also available are mount, user, UTS (Unix Time Sharing), network and SysV IPC namespaces. • The
PID namespace provides isolation for the allocation of
process identifiers (PIDs), lists of processes and their details. While the new namespace is isolated from other siblings, processes in its "parent" namespace still see all processes in child namespaces—albeit with different PID numbers. •
Network namespace isolates the
network interface controllers (physical or virtual),
iptables firewall rules, routing tables etc. Network namespaces can be connected with each other using the "veth" virtual Ethernet device. •
"UTS" namespace allows changing the
hostname. •
Mount namespace allows creating a different file system layout, or making certain mount points read-only. •
IPC namespace isolates the System V
inter-process communication between namespaces. •
User namespace isolates the user IDs between namespaces. •
Cgroup namespace Namespaces are created with the "unshare" command or
syscall, or as "new" flags in a "clone" syscall. The "ns" subsystem was added early in cgroups development to integrate namespaces and control groups. If the "ns" cgroup was mounted, each namespace would also create a new group in the cgroup hierarchy. This was an experiment that was later judged to be a poor fit for the cgroups API, and removed from the kernel. Linux namespaces were inspired by the more general namespace functionality used heavily throughout
Plan 9 from Bell Labs.
Conversion to kernfs Kernfs was introduced into the Linux kernel with version 3.14 in March 2014, the main author being Tejun Heo. One of the main motivators for a separate kernfs is the cgroups file system. Kernfs is basically created by splitting off some of the
sysfs logic into an independent entity, thus easing for other kernel subsystems the implementation of their own virtual file system with handling for device connect and disconnect, dynamic creation and removal, and other attributes. This does not affect how cgroups is used, but makes maintaining the code easier.
New features introduced during v1 Kernel memory control groups ('''') were merged into version 3.8 () of the
Linux kernel mainline. The kmemcg controller can limit the amount of memory that the kernel can utilize to manage its own internal processes. Support for per-group
netfilter setup was added in 2014.
Changes after v2 Unlike v1, cgroup v2 has only a single process hierarchy and discriminates between processes, not threads.
cgroup awareness of OOM killer Linux Kernel 4.19 (October 2018) introduced cgroup awareness of
OOM killer implementation which adds an ability to kill a cgroup as a single unit and so guarantee the integrity of the workload. == Adoption ==