Cgroup

A cgroup accounts for and limits the resources that a group of processes uses: CPU shares, memory caps, and I/O.

A cgroup limits what a process can use, and a namespace limits what a process can see. A cgroup applies to a group of processes, and it both accounts for the resource use of the group and limits that use. The resources under its control are CPU shares, memory caps, and I/O. The kernel enforces the shares and caps when the host is oversubscribed.