Container Resource Allocation & cgroups

By default, Docker imposes no restrictions on the amount of system resources that a container can use. 

Control groups (or cgroups) are a Linux kernel feature that allows you to allocate, limit, and isolate resource usage (such as CPU, memory, disk I/O, network bandwidth, etc.) for processes or groups of processes. Docker and other container runtimes use cgroups to manage and enforce resource limits on containers.

Setting resource caps

CPU

Limit CPU core usage:

docker run --cpuset-cpus="0,1" nginx

This restricts the container to only use CPU cores 0 and 1.

Limit CPU usage percentage

docker run --cpus="1.5" nginx

This limits the container to use 1.5 CPUs worth of processing power, even if the host has more.

Memory

Memory restrictions can be implemented using the --memory= flag:

Limit container to 500m:

docker run --memory="500m" nginx

Limit SWAP usage to 1G:

--memory-swap="1g"