I set up cgroups on a shared system to limit the cpu access to a group to 25% but it does not seem to be working. Here are the steps followed:

  1. Add this line to /etc/cgrules.conf:

    @guest_users cpu lowcpu

In the above record, @guest_users is the Linux group whose members I'd like to limit the cpu usage, cpu is the controller and lowcpu is the handle to configure the cgroup as shown in next step.

  1. Add the following lines to /etc/cgconfig.conf:

    group lowcpu{
  2. Enable and restart the cgred and cgconfig services using systemctl.

I am running CentOS system 7.5, kernel 3.10 with 32 cores.

I do see the dir /sys/fs/cgroup/cpu/lowcpu is created and the file cpu.shares has a line 256 in it.

Despite all this, I find with top that users in the guest_users group are still able to overload the cpu. Any suggestions as to what could be the possible cause and routes to debug the problem?


This answer on stackoverflow helped. I find that the kernel will kick in the cpu.shares rule only when there is a contention on CPU between the cgroup and system processes. If no contention, all CPU resources may be used by the cgroup. Adding the following lined to the cpu section did the trick:


The effect of the above lines is that for every second of cpu a slice of 0.8 second will be given to the cgroup processes.

To verify if the cgroup is created and is active, the commands systemd-cgls and systemd-cgtop were useful.

Your Answer

