How does Kubernetes use cgroups to manage resource limits?

Kubernetes uses cgroups (control groups) to manage resources of containers, such as CPU and memory. When creating a pod, kubelet assigns containers to appropriate cgroups with limits specified in the pod's specification (requests and limits) via the container runtime (e.g., Docker or containerd).

Cgroups allow the Linux kernel to limit and isolate resource consumption by processes. Kubernetes translates resource values from the manifest into cgroup parameters:

• CPU: limited through quotas and time period (cpu.cfs_quota_us and cpu.cfs_period_us), which restricts CPU share.
• Memory: a maximum amount of memory that the container can use is set (memory.limit_in_bytes).

Thus, cgroups provide efficient and isolated resource distribution among pods, preventing limit exceedance and ensuring quality of service guarantees.