Examkin

Question

Difficulty: MediumVirtualization and Containerization Security

A DevOps team is deploying microservices within a containerized environment on Linux host servers. The system administrator needs to enforce hard limits on CPU usage and memory consumption for individual containers to prevent a single compromised or misconfigured container from exhausting shared host system resources. Which Linux kernel mechanism should be configured to directly enforce these resource limits?

  1. Control groups (cgroups)Answer
  2. B
    Namespaces
  3. C
    Type 1 Bare-Metal Hypervisor hardware partitioning
  4. D
    Perimeter network firewalls

Answer

Control groups (cgroups) are used to limit and isolate physical resource consumption such as CPU and RAM for container processes.
Control groups (cgroups) are the Linux kernel feature designed specifically to restrict, allocate, and measure hardware resources (CPU, RAM, block I/O) assigned to containerized process hierarchies.

Step-by-Step Solution

1
Identify the goal of the control
The requirement is host-level CPU and memory resource governance for containerized applications.
Preventing a single container from starving host resources requires kernel-level resource allocation constraints.
2
Differentiate container kernel mechanisms
Linux namespaces provide visibility isolation (viewing processes, network cards, IPC), whereas control groups (cgroups) regulate hardware resource consumption boundaries.
cgroups explicitly handle resource metering and throttling for process collections.

Key Concept

Resource isolation and constraint mechanisms in container security (cgroups vs namespaces)
Rate this question

Topics

Virtualization and Containerization Security

More questions from this topic