Cgroup有什么作用

# 设置内存使用上限
echo "100M" > /sys/fs/cgroup/memory/group1/memory.limit_in_bytes

# 设置内存+Swap 上限
echo "200M" > /sys/fs/cgroup/memory/group1/memory.memsw.limit_in_bytes

# 查看内存使用情况
cat /sys/fs/cgroup/memory/group1/memory.usage_in_bytes
cat /sys/fs/cgroup/memory/group1/memory.stat

# 设置内存回收压力
echo 100 > /sys/fs/cgroup/memory/group1/memory.swappiness

# 限制读带宽 1MB/s
echo "8:0 1048576" > /sys/fs/cgroup/blkio/group1/blkio.throttle.read_bps_device

# 限制写带宽 2MB/s  
echo "8:0 2097152" > /sys/fs/cgroup/blkio/group1/blkio.throttle.write_bps_device

# 限制每秒读操作数
echo "8:0 100" > /sys/fs/cgroup/blkio/group1/blkio.throttle.read_iops_device

# 限制每秒写操作数
echo "8:0 50" > /sys/fs/cgroup/blkio/group1/blkio.throttle.write_iops_device

# 设置 I/O 优先级权重（100-1000）
echo 500 > /sys/fs/cgroup/blkio/group1/blkio.weight

# 限制最大进程数
echo 100 > /sys/fs/cgroup/pids/group1/pids.max

# 查看当前进程数
cat /sys/fs/cgroup/pids/group1/pids.current

# 允许访问设备
echo "c 1:3 rwm" > /sys/fs/cgroup/devices/group1/devices.allow

# 拒绝访问设备
echo "c 1:5 rwm" > /sys/fs/cgroup/devices/group1/devices.deny

# 设置网络流量类ID
echo 0x100001 > /sys/fs/cgroup/net_cls/group1/net_cls.classid

# 设置网络接口优先级
echo "eth0 5" > /sys/fs/cgroup/net_prio/group1/net_prio.ifpriomap

# 限制挂载命名空间操作
echo 1 > /sys/fs/cgroup/group1/devices.deny

# 内存低水位线保护
echo "min 50M" > /sys/fs/cgroup/group1/memory.low

# CPU 权重保护
echo 100 > /sys/fs/cgroup/group1/cpu.weight

# I/O 权重
echo "default 100" > /sys/fs/cgroup/group1/io.weight

# I/O 最大带宽
echo "8:0 rbps=1048576 wbps=2097152" > /sys/fs/cgroup/group1/io.max

# Docker 容器资源限制
docker run -it \
  --cpus="0.5" \
  --memory="100m" \
  --blkio-weight=500 \
  --pids-limit=100 \
  ubuntu:latest

[Service]
MemoryMax=100M
IOWeight=500
TasksMax=100
DeviceAllow=/dev/null rw
DeviceAllow=/dev/zero rw
DeviceAllow=/dev/full rw

apiVersion: v1
kind: Pod
spec:
  containers:
  - name: app
    resources:
      limits:
        cpu: "500m"
        memory: "128Mi"
        ephemeral-storage: "1Gi"
      requests:
        cpu: "250m" 
        memory: "64Mi"

# 查看 cgroup 资源使用
cat /sys/fs/cgroup/memory/group1/memory.stat
cat /sys/fs/cgroup/cpu/group1/cpu.stat
cat /sys/fs/cgroup/io/group1/io.stat

# 查看内存压力
cat /sys/fs/cgroup/memory/group1/memory.pressure

# 允许子 cgroup 管理特定资源
echo "+memory +io" > /sys/fs/cgroup/group1/cgroup.subtree_control

# 暂停 cgroup 中所有进程
echo 1 > /sys/fs/cgroup/group1/cgroup.freeze

# 恢复执行
echo 0 > /sys/fs/cgroup/group1/cgroup.freeze