Container 05: Cgroups, Memory and Process Limits

The walls Kubernetes puts around untrusted code. The ceiling on memory and on process count is one of them, and this stage builds it.

Before you start. Container 04: /proc and /dev finished the walls that change what a box can see. This stage adds the one that changes how much it can use. You need to know that a program’s memory is the RAM the kernel has handed it, and that a process is a running program (Processes, Threads & the Kernel). A fork bomb is a program that makes copies of itself without end, each copy making more, until the machine has no room for anything else. You do not need to have seen one.