Lab 2: Inspecting cgroups — what limits actually apply

Objective

Docker’s resource limits are Linux cgroup limits. This lab shows the cgroup files that actually apply to a container’s processes, and demonstrates the OOM-killer’s behaviour when the limit is reached.

Requirements

• A Linux host (kernel 5.15+ recommended).
• Docker installed.
• A container to inspect.

Tasks

Task 1: Find the cgroup of a container’s process

Start a container:

docker run --rm -d --name cgrouptest --memory 256m --cpus 1.5 \
  nginx:1.27 sleep 3600

Find the container’s PID and its cgroup:

PID=$(docker inspect cgrouptest --format '{{.State.Pid}}')
echo "Container PID: $PID"

cat /proc/$PID/cgroup

Task 2: Read the cgroup resource limits

CGROUP=$(cat /proc/$PID/cgroup | awk -F: '{print $3}')
BASE=/sys/fs/cgroup$CGROUP

cat $BASE/memory.max
cat $BASE/cpu.max
cat $BASE/pids.max

Task 3: Try to OOM the container

docker exec cgrouptest sh -c "dd if=/dev/zero of=/dev/shm/test bs=1M count=300"

This should fail because the cgroup limit is 256 MB.

Task 4: Check the kernel’s response

sudo dmesg | tail -20

Task 5: Verify the OOMKilled flag

docker inspect cgrouptest --format '{{.State.OOMKilled}} {{.State.ExitCode}}'

Task 6: Clean up

docker stop cgrouptest