How to Set Up cgroups for Security

Step 1: Install cgroup-tools

sudo apt install cgroup-tools -y

Step 2: Create a New cgroup

sudo cgcreate -g cpu,memory:secure_group

Step 3: Set Limits

sudo cgset -r cpu.max="50000 100000" secure_group
sudo cgset -r memory.max="512M" secure_group

Step 4: Run Process in cgroup

sudo cgexec -g cpu,memory:secure_group my_application

Step 5: Move Existing Process

sudo cgclassify -g cpu,memory:secure_group [PID]

Step 6: Automate with systemd

sudo nano /etc/systemd/system/myapp.service

Add:

[Service]
CPUQuota=50%
MemoryMax=512M