Container security fundamentals part 4: Cgroups

This post explains how Linux cgroups v2 control CPU, process counts, and device access to improve container security and stability, showing how to inspect cgroups via /proc, /sys, systemd-cgls, and lscgroup, and how to enforce limits using Docker flags (--cpus, --pids-limit, --device) to mitigate DoS scenarios (e.g., stress, fork bombs) and manage device access with eBPF-backed controls.