cgroup
A Linux kernel mechanism for process resource isolation and management that groups a set of processes into a single control group, enabling limits on CPU, memory, and other resources, as well as bulk signal delivery to processes. It is a foundational component of container technology.
Core Facts
Timeline (last 90 days)
Before running Strata on a rented container, you should check the CPU quota via cat /sys/fs/cgroup/cpu.max and set --pool-workers to a value slightly below the allowed core count
Operating-system-level sandboxes on Linux use seccomp to filter system calls, combined with namespaces to isolate mount and network views, and then cgroups to limit resources.
Linux's cgroup mechanism can place a group of processes under the same control group and send termination signals to all processes in the group at once, which is equally effective for multi-level subprocess spawning.
The cgroup approach provides the most thorough cleanup on Linux, but macOS support is limited; the process group approach has better cross-platform compatibility but is powerless against escaped processes that have already detached from the process group.
The methodology for reverse-engineering sandboxes includes environment probing (reading system information, process lists, kernel versions, and cgroup configurations).
Containers (Docker/LXC) achieve isolation through namespaces + cgroups, share the host kernel, and incur extremely low performance overhead.
Linux的namespace提供PID、Network、Mount、UTS、IPC和User等多种隔离维度，cgroup负责资源限制和计量
All Facts (8)
容器技术（以Docker为代表）利用Linux内核的namespace机制实现进程、网络、文件系统隔离，借助cgroups限制CPU、内存等资源用量
80%UnverifiedBefore running Strata on a rented container, you should check the CPU quota via cat /sys/fs/cgroup/cpu.max and set --pool-workers to a value slightly below the allowed core count
50%UnverifiedOperating-system-level sandboxes on Linux use seccomp to filter system calls, combined with namespaces to isolate mount and network views, and then cgroups to limit resources.
50%UnverifiedLinux's cgroup mechanism can place a group of processes under the same control group and send termination signals to all processes in the group at once, which is equally effective for multi-level subprocess spawning.
50%UnverifiedThe cgroup approach provides the most thorough cleanup on Linux, but macOS support is limited; the process group approach has better cross-platform compatibility but is powerless against escaped processes that have already detached from the process group.
50%UnverifiedThe methodology for reverse-engineering sandboxes includes environment probing (reading system information, process lists, kernel versions, and cgroup configurations).
50%UnverifiedContainers (Docker/LXC) achieve isolation through namespaces + cgroups, share the host kernel, and incur extremely low performance overhead.
50%UnverifiedLinux的namespace提供PID、Network、Mount、UTS、IPC和User等多种隔离维度，cgroup负责资源限制和计量
50%