cgroup
A Linux kernel mechanism for process resource isolation and management that groups a set of processes into a single control group, enabling limits on CPU, memory, and other resources, as well as bulk signal delivery to processes. It is a foundational component of container technology.
Core Facts
Timeline (last 90 days)
Kernel-level restrictions typically use mechanisms such as seccomp, Landlock, and cgroup to intercept system calls by whitelist or rules when they enter the kernel, making them harder to bypass than application-layer hooks.
Namespaces govern "what you can see" (PID, mount, network, user and other isolation), while cgroups govern "how much you use" (metering and limiting CPU, memory, IO and other resources).
systemd-nspawn is a container management tool shipped with the systemd project that uses Linux namespaces and control groups (cgroups) to isolate processes, filesystems, networking and other dimensions while sharing the kernel with the host.
Containers rely on namespaces and cgroups for logical isolation and still share the host kernel; once a privilege escalation vulnerability appears in the kernel, an attacker may cross container boundaries.
Before running Strata on a rented container, you should check the CPU quota via cat /sys/fs/cgroup/cpu.max and set --pool-workers to a value slightly below the allowed core count
Operating-system-level sandboxes on Linux use seccomp to filter system calls, combined with namespaces to isolate mount and network views, and then cgroups to limit resources.
Cgroups can precisely limit and account for resources such as CPU, memory, and disk I/O for a group of processes.
The cgroup approach provides the most thorough cleanup on Linux, but macOS support is limited; the process group approach has better cross-platform compatibility but is powerless against escaped processes that have already detached from the process group.
Linux's cgroup mechanism can place a group of processes under the same control group and send termination signals to all processes in the group at once, which is equally effective for multi-level subprocess spawning.
The methodology for reverse-engineering sandboxes includes environment probing (reading system information, process lists, kernel versions, and cgroup configurations).
2 more timeline events
All Facts (14)
容器技术（以Docker为代表）利用Linux内核的namespace机制实现进程、网络、文件系统隔离，借助cgroups限制CPU、内存等资源用量
80%VerifiedDocker基于Linux内核的cgroups（资源限制）和namespace（进程隔离）机制实现容器化
80%UnverifiedKernel-level restrictions typically use mechanisms such as seccomp, Landlock, and cgroup to intercept system calls by whitelist or rules when they enter the kernel, making them harder to bypass than application-layer hooks.
50%UnverifiedNamespaces govern "what you can see" (PID, mount, network, user and other isolation), while cgroups govern "how much you use" (metering and limiting CPU, memory, IO and other resources).
50%Unverifiedsystemd-nspawn is a container management tool shipped with the systemd project that uses Linux namespaces and control groups (cgroups) to isolate processes, filesystems, networking and other dimensions while sharing the kernel with the host.
50%UnverifiedContainers rely on namespaces and cgroups for logical isolation and still share the host kernel; once a privilege escalation vulnerability appears in the kernel, an attacker may cross container boundaries.
50%UnverifiedBefore running Strata on a rented container, you should check the CPU quota via cat /sys/fs/cgroup/cpu.max and set --pool-workers to a value slightly below the allowed core count
50%UnverifiedOperating-system-level sandboxes on Linux use seccomp to filter system calls, combined with namespaces to isolate mount and network views, and then cgroups to limit resources.
50%UnverifiedCgroups can precisely limit and account for resources such as CPU, memory, and disk I/O for a group of processes.
50%UnverifiedLinux's cgroup mechanism can place a group of processes under the same control group and send termination signals to all processes in the group at once, which is equally effective for multi-level subprocess spawning.
50%UnverifiedThe cgroup approach provides the most thorough cleanup on Linux, but macOS support is limited; the process group approach has better cross-platform compatibility but is powerless against escaped processes that have already detached from the process group.
50%UnverifiedThe methodology for reverse-engineering sandboxes includes environment probing (reading system information, process lists, kernel versions, and cgroup configurations).
50%UnverifiedContainers (Docker/LXC) achieve isolation through namespaces + cgroups, share the host kernel, and incur extremely low performance overhead.
50%UnverifiedLinux的namespace提供PID、Network、Mount、UTS、IPC和User等多种隔离维度，cgroup负责资源限制和计量
50%