In the constant pursuit for workload isolation and resource optimization, we witnessed the move from physical to virtualized machines using hypervisors. Using virtualization implies a certain degree of resource usage inefficiency, as the storage, CPU, and memory need to be allocated to each running VM whether it uses them or not. A lot of work has been done in this area to mitigate such inefficiencies but, in the end, fully taking advantage of system resources is still a difficult problem.
With the rise of operating-system-level virtualization on Linux (that is, the use of containers), the mindset changed. We no longer want a full copy of an OS for each workload, but instead, only properly isolated processes to do the desired work. To achieve this, and focusing specifically on Linux containers, a set of kernel features responsible for isolating hardware resources...