Namespaces provide isolation by giving processes separate views of system resources, while Cgroups control resource usage such as CPU, memory, and I/O. 1. PID, Mount, Network, UTS, IPC, User, and Cgroup namespaces isolate process trees, filesystems, network stacks, hostnames, inter-process communication, user IDs, and cgroup hierarchies respectively. 2. Cgroups limit, account for, and prioritize resource usage, enforcing constraints like memory and CPU limits. 3. Together, they enable containers to be isolated and resource-controlled, forming the foundation of container technologies like Docker and Kubernetes, making lightweight, secure, and efficient application environments possible.

Linux Namespaces and Cgroups are two fundamental kernel features that enable process isolation and resource management—key components behind technologies like containers (e.g., Docker, Kubernetes). While they serve different purposes, they work together to create lightweight, secure, and efficient isolated environments.

What Are Linux Namespaces?

Namespaces provide isolation by partitioning global system resources so that different processes see different "views" of the system. This makes it appear as if each group of processes has its own separate environment.

Each namespace encapsulates a specific aspect of the system. Common types include:

• PID (Process ID): Processes in different PID namespaces see separate process trees. A container can have its own init process (PID 1), isolated from the host.
• Mount: Allows isolated file system mount points. One container can mount or unmount filesystems without affecting others.
• Network: Gives processes their own network stack (interfaces, IP addresses, routing tables, etc.).
• UTS (Unix Timesharing System): Lets processes have different hostnames and domain names.
• IPC (Inter-Process Communication): Isolates shared memory, message queues, and semaphores.
• User: Enables mapping of UIDs and GIDs between the host and the namespace, improving security by allowing a process to be root inside the container but non-root on the host.
• Cgroup: Controls visibility of cgroup hierarchies, allowing nested containers to manage their own cgroups.

? Think of namespaces as scopes that define what a process can see.

What Are Cgroups (Control Groups)?

Cgroups (specifically cgroups v2 now recommended) are about resource control and accounting. They limit, account for, and isolate resource usage (CPU, memory, disk I/O, network, etc.) across groups of processes.

Key capabilities:

• Limit memory usage: Prevent a container from consuming all system RAM.
• CPU allocation: Assign CPU shares or limit CPU time.
• Freeze/resume groups of processes: Useful for checkpointing or live migration.
• Prioritize I/O: Ensure critical containers get better disk throughput.
• Track resource usage: Monitor how much CPU or memory a group of processes uses.

Cgroups organize processes into hierarchical groups, where each level can have resource limits applied. The kernel enforces these limits.

? Think of cgroups as enforcers that define what a process can use.

How Do Namespaces and Cgroups Work Together?

Containers leverage both:

1. Namespaces make the container feel isolated—its own filesystem, processes, network, etc.
2. Cgroups ensure the container doesn’t hog resources—e.g., limiting it to 2GB of RAM or 50% CPU.

For example, when you run:

docker run -m 512m --cpus=1.0 ubuntu

• Cgroups enforce the 512MB memory and 1 CPU limit.
• Namespaces isolate the container’s view of processes, network, mounts, etc.

Without both, true containerization wouldn’t be possible.

Bottom Line

• Namespaces = Isolation (what you can see)
• Cgroups = Resource control (what you can use)

Together, they form the backbone of modern Linux containerization—no need for full virtual machines, just efficient, secure, and portable application environments.

Basically, they’re the unsung heroes that make Docker and Kubernetes possible.

The above is the detailed content of What are Linux Namespaces and Cgroups?. For more information, please follow other related articles on the PHP Chinese website!