Linux Desktops and User Land Infrastructure

Configuring cgroups v2 on the Desktop to Prevent Web Browsers From Starving Critical Terminal Compilations

Scríofa ag Kinetikatech Operations Team · Nuashonraithe 2026-09-14

A browser with many tabs can consume every CPU cycle and gigabyte of RAM on a workstation, stalling terminal compilations and interactive shells. cgroups v2 lets you cap the browser's resources at the kernel level without changing how you launch it. This guide sets up user-scoped cgroups on a desktop.

Príomhphointí

Enable cgroups v2. Most modern distributions use it by default; verify with mount | grep cgroup2.
Create a browser slice. Use systemd-run or a transient unit to place the browser in a capped cgroup.
Set CPU and memory limits. cpu.max and memory.max enforce hard ceilings that the kernel honors.
Protect terminal sessions. Give the shell and build processes a higher cpu.weight so they preempt the browser.
Use memory.high for graceful pressure. It triggers reclaim before the hard limit, avoiding sudden kills.
Monitor with systemd-cgtop. Watch per-cgroup usage to confirm limits are effective.
Persist via unit files. Drop-in units for the browser keep the configuration across reboots.
Test under load. Run a heavy browser workload alongside a compilation and measure completion time.

Architecture

cgroups v2 organizes processes into a hierarchy where each node carries resource controllers. The browser lives in a capped leaf, terminal sessions live in a protected leaf, and the root distributes leftover capacity. The kernel enforces limits atomically, so no userspace cooperation is required.

Production configuration

Create a capped browser cgroup bash

systemd-run --user --scope --unit=browser-capped \
  -p CPUQuota=200% \
  -p MemoryMax=4G \
  -p MemoryHigh=3G \
  firefox

# verify
systemd-cgtop --depth=2

Persistent drop-in unit ini

# ~/.config/systemd/user/browser-capped.service
[Unit]
Description=Capped browser session

[Service]
ExecStart=/usr/bin/firefox
CPUQuota=200%
MemoryMax=4G
MemoryHigh=3G
Slice=app-browser.slice

[Install]
WantedBy=default.target

Protect terminal and build processes bash

# Raise weight for the terminal slice
systemctl --user set-property app-terminal.slice CPUWeight=200
systemctl --user set-property app-terminal.slice MemoryLow=1G

# check weights
cat /sys/fs/cgroup/user.slice/user-1000.slice/app-terminal.slice/cpu.weight

Edge cases from production

Browsers spawn many child processes; the cgroup must cover the whole subtree, which systemd scopes handle automatically.
GPU-accelerated rendering bypasses CPU limits for graphics work; cap GPU memory separately if needed.
MemoryMax kills the browser abruptly; use MemoryHigh first and only escalate if pressure persists.
Flatpak apps run in their own cgroup namespace; limits must be applied at the flatpak level.

Ceisteanna coitianta

Do I need root to use cgroups v2?

No, user-scoped cgroups are available to unprivileged users via systemd on most distributions.

Will cgroups slow my browser?

Only when it exceeds the cap; below the limit there is no overhead.

Can I limit a single tab?

No, cgroups work at the process level; browsers that isolate tabs in processes can be limited per process but not per tab.

What is the difference between v1 and v2?

v2 uses a unified hierarchy and improved controllers; v1's split hierarchy is harder to manage and is being phased out.

How do I remove a limit?

Set the property to infinity or remove the drop-in and reload systemd.

Conas a chabhraíonn Kinetikatech le linux desktops and user land infrastructure

Ní gá duit a bheith i do shaineolaí ar linux desktops and user land infrastructure: Hardening compositors, sandboxing desktop apps, and tuning the user land that developers and operators actually touch. Is ar an gcúis sin go díreach atá Bainistíocht Freastalaithe agus Cothabháil Suíomh Gréasáin ann: cur i mbun, daingniú, faireachán agus duine ar dualgas de lá is d'oíche.

Labhair le hinnealtóir