Which Linux feature is used by Kubernetes to isolate containers and limit the resource usage of a process or set of processes?

Which Linux feature is used by Kubernetes to isolate containers and limit the resource usage of a process or set of processes?

• A. Namespacess
• B. Cgroups
• C. Chroot
• D. AppArmor

Answer: (B)

Cgroups provide the mechanism for both isolating and enforcing resource limits for containers. In Kubernetes, each container runs inside its own control group, and the Pod spec’s resource requests and limits are translated into CPU, memory, and other quota boundaries applied to that group. This ensures a container can’t exceed its allocated resources and helps maintain node stability by preventing one container from starving others. Namespaces handle isolation of kernel resources like PID trees, network stacks, and mounts, but they don’t enforce resource usage limits. Chroot is a filesystem isolation technique, and AppArmor offers security profiles rather than resource quotas. Therefore, the feature that Kubernetes uses to isolate containers and cap their resource usage is cgroups.

Cgroups provide the mechanism for both isolating and enforcing resource limits for containers. In Kubernetes, each container runs inside its own control group, and the Pod spec’s resource requests and limits are translated into CPU, memory, and other quota boundaries applied to that group. This ensures a container can’t exceed its allocated resources and helps maintain node stability by preventing one container from starving others.

Namespaces handle isolation of kernel resources like PID trees, network stacks, and mounts, but they don’t enforce resource usage limits. Chroot is a filesystem isolation technique, and AppArmor offers security profiles rather than resource quotas. Therefore, the feature that Kubernetes uses to isolate containers and cap their resource usage is cgroups.