Cap Container CPU and Memory at Run Time

Every container on a Linux host shares one kernel, one CPU scheduler, and one memory pool. Without resource ceilings, a single runaway process inside a container can pin every core, exhaust RAM, and starve every other workload on the box. Docker exposes a small set of run-time flags that map directly to Linux cgroups v2 controllers: --memory caps RSS, --cpus caps CPU time, and --cpu-shares weights contention. When the kernel sees a container cross its memory ceiling, the OOM killer fires and the container exits with code 137, the SIGKILL fingerprint that operators learn to recognize at a glance.

The same primitives that enforce these flags are the foundation under Kubernetes requests and limits, systemd slices, and every other container runtime in production. A learner who can read docker stats and connect what they see to --memory 128m will later debug evicted pods, throttled workloads, and noisy-neighbor incidents without it feeling like black magic. In this lab, you will run busybox and alpine containers under increasingly tight ceilings, watch live consumption with docker stats, and deliberately push a workload past its memory limit to witness the OOM killer end the process and stamp exit code 137 on the container.

Objectives

Upon completion of this beginner level lab, you will be able to:

• Run a container with no ceilings and capture an unconstrained CPU and memory baseline with docker stats
• Cap a container's memory with --memory and disable swap by setting --memory-swap to the same value
• Cap CPU time with --cpus and contrast it against weight-based --cpu-shares under contention
• Reproduce an OOM kill by exceeding the memory ceiling and identify exit code 137 as the SIGKILL fingerprint

Who is this lab for?

This lab is designed for:

• Beginner Docker users who can run basic containers and now need to understand the cgroup-backed resource ceilings underneath
• Platform engineers and SREs preparing to debug evicted Kubernetes pods, throttled workloads, and noisy-neighbor incidents in production