Linux Desktops and User Land Infrastructure

Configuring cgroups v2 on the Desktop to Prevent Web Browsers From Starving Critical Terminal Compilations

作者 Kinetikatech Operations Team · 更新于 2026-09-14

A browser with many tabs can consume every CPU cycle and gigabyte of RAM on a workstation, stalling terminal compilations and interactive shells. cgroups v2 lets you cap the browser's resources at the kernel level without changing how you launch it. This guide sets up user-scoped cgroups on a desktop.

要点

Enable cgroups v2. Most modern distributions use it by default; verify with mount | grep cgroup2.
Create a browser slice. Use systemd-run or a transient unit to place the browser in a capped cgroup.
Set CPU and memory limits. cpu.max and memory.max enforce hard ceilings that the kernel honors.
Protect terminal sessions. Give the shell and build processes a higher cpu.weight so they preempt the browser.
Use memory.high for graceful pressure. It triggers reclaim before the hard limit, avoiding sudden kills.
Monitor with systemd-cgtop. Watch per-cgroup usage to confirm limits are effective.
Persist via unit files. Drop-in units for the browser keep the configuration across reboots.
Test under load. Run a heavy browser workload alongside a compilation and measure completion time.

Architecture

cgroups v2 organizes processes into a hierarchy where each node carries resource controllers. The browser lives in a capped leaf, terminal sessions live in a protected leaf, and the root distributes leftover capacity. The kernel enforces limits atomically, so no userspace cooperation is required.

Production configuration

Create a capped browser cgroup bash

systemd-run --user --scope --unit=browser-capped \
  -p CPUQuota=200% \
  -p MemoryMax=4G \
  -p MemoryHigh=3G \
  firefox

# verify
systemd-cgtop --depth=2

Persistent drop-in unit ini

# ~/.config/systemd/user/browser-capped.service
[Unit]
Description=Capped browser session

[Service]
ExecStart=/usr/bin/firefox
CPUQuota=200%
MemoryMax=4G
MemoryHigh=3G
Slice=app-browser.slice

[Install]
WantedBy=default.target

Protect terminal and build processes bash

# Raise weight for the terminal slice
systemctl --user set-property app-terminal.slice CPUWeight=200
systemctl --user set-property app-terminal.slice MemoryLow=1G

# check weights
cat /sys/fs/cgroup/user.slice/user-1000.slice/app-terminal.slice/cpu.weight

Edge cases from production

Browsers spawn many child processes; the cgroup must cover the whole subtree, which systemd scopes handle automatically.
GPU-accelerated rendering bypasses CPU limits for graphics work; cap GPU memory separately if needed.
MemoryMax kills the browser abruptly; use MemoryHigh first and only escalate if pressure persists.
Flatpak apps run in their own cgroup namespace; limits must be applied at the flatpak level.

常见问题

Do I need root to use cgroups v2?

No, user-scoped cgroups are available to unprivileged users via systemd on most distributions.

Will cgroups slow my browser?

Only when it exceeds the cap; below the limit there is no overhead.

Can I limit a single tab?

No, cgroups work at the process level; browsers that isolate tabs in processes can be limited per process but not per tab.

What is the difference between v1 and v2?

v2 uses a unified hierarchy and improved controllers; v1's split hierarchy is harder to manage and is being phased out.

How do I remove a limit?

Set the property to infinity or remove the drop-in and reload systemd.

Kinetikatech 如何在linux desktops and user land infrastructure方面为您提供帮助

这是我们的日常工作：Hardening compositors, sandboxing desktop apps, and tuning the user land that developers and operators actually touch.我们的服务器管理和网站维护服务提供端到端覆盖：评估、实施、24/7 监控，以及 30 分钟内的应急响应。

与工程师交谈