How do resource limits (memory and CPU) work for Docker containers?
Understand how Docker memory and CPU limits work with cgroups, --memory, --cpus, and --cpu-shares to prevent noisy neighbors and OOM crashes.
Expected Interview Answer
Docker resource limits use the host kernel's cgroups to cap how much memory and CPU a container may consume, set through flags like --memory and --cpus so one container cannot starve the host or its neighbors.
Memory limits (--memory, --memory-swap) put a hard ceiling on RAM; exceeding it triggers the kernel OOM killer, which terminates processes in the container. CPU controls come in two flavours: --cpus and --cpu-quota/--cpu-period cap absolute CPU time, while --cpu-shares only sets a relative weight that matters when the host is contended. Limits are enforced by cgroups, so they are real kernel-level constraints, not just advisory.
- Prevents a noisy neighbor from starving other containers
- Protects the host from out-of-memory crashes
- Enables predictable performance and capacity planning
- Supports fair CPU sharing under contention
- Required for safe multi-tenant scheduling
AI Mentor Explanation
In a limited-overs match each bowler may bowl only a fixed quota of overs — no single bowler can dominate the whole innings. That per-bowler cap is a hard limit enforced by the umpire. Container CPU and memory limits are the umpire's over-quota: each container gets an allotted share of the host's resources and cannot exceed it.
Step-by-Step Explanation
Step 1
Pick the resource
Decide whether you are capping memory (--memory), CPU (--cpus), or relative CPU priority (--cpu-shares).
Step 2
Set a memory ceiling
Use --memory 512m and optionally --memory-swap to bound total RAM plus swap the container may use.
Step 3
Set CPU limits
Use --cpus 1.5 for a hard fractional-core cap, or --cpu-shares 512 for relative weighting under contention.
Step 4
Run the container
Docker writes these values into the container's cgroup so the kernel enforces them from process start.
Step 5
Monitor and tune
Use docker stats to watch usage, and adjust limits so workloads stay within budget without OOM kills.
What Interviewer Expects
- Knows limits are enforced by kernel cgroups
- Distinguishes hard --cpus quota from relative --cpu-shares
- Explains the OOM killer when memory is exceeded
- Mentions --memory-swap and swap accounting
- Uses docker stats or similar to observe usage
Common Mistakes
- Thinking --cpu-shares is a hard cap rather than a relative weight
- Ignoring --memory-swap and being surprised by swap usage
- Assuming limits are advisory rather than kernel-enforced
- Not accounting for the OOM killer terminating processes
- Setting CPU limits above the host's physical core count expecting more throughput
Best Answer (HR Friendly)
“Docker lets you cap how much memory and CPU each container can use so a single container cannot hog the machine or crash it. These limits are enforced by the operating system, keeping applications running side by side in a fair and predictable way.”
Code Example
# Hard-cap memory at 512MB and CPU at 1.5 cores
docker run -d \
--name api \
--memory 512m \
--memory-swap 512m \
--cpus 1.5 \
myapp:latest
# Relative CPU weight (only matters under contention)
docker run -d --cpu-shares 512 batch-worker:latest
# Watch live resource usage
docker stats apiFollow-up Questions
- What happens when a container exceeds its memory limit?
- How does --cpus differ from --cpu-shares?
- What role do cgroups play in enforcing these limits?
- How do you set the same limits in docker-compose?
- Why can setting --cpus above the host core count not help?
MCQ Practice
1. What happens when a container exceeds its --memory limit?
Exceeding the hard memory limit triggers the kernel OOM killer, which kills processes in the container's cgroup.
2. Which flag sets a RELATIVE CPU priority rather than a hard cap?
--cpu-shares only sets a relative weight that matters under contention; --cpus is the hard cap.
3. What mechanism actually enforces Docker resource limits?
Docker configures Linux kernel control groups (cgroups), which enforce CPU and memory constraints.
Flash Cards
What enforces Docker resource limits? — Linux kernel control groups (cgroups) configured by the Docker daemon.
--cpus vs --cpu-shares? — --cpus is a hard fractional-core cap; --cpu-shares is a relative weight applied only under contention.
What triggers the OOM killer? — A container exceeding its hard --memory limit; the kernel kills processes to reclaim RAM.
How to watch container resource usage? — Run docker stats to see live CPU, memory, and I/O per container.