Process and CGroups.

Using CGroups we can limit maximum amount of RAM and CPU can be consumed by a process.

Without creating a CGroup we can directly start a process with certain limits using systemd-run

sudo systemd-run --scope -p CPUQuota=10% -p MemoryMax=500M <process_name>

if want it more static, you can create a cgroup and configure limits then map the process ID to that Cgroup.

Create a new cgroup and set limits

laborant@ubuntu-01:~$ sudo mkdir /sys/fs/cgroup/my_custom_limit
laborant@ubuntu-01:~$ echo "+cpu +memory" | sudo tee /sys/fs/cgroup/cgroup.subtree_control
+cpu +memory
laborant@ubuntu-01:~$ cd /sys/fs/cgroup/my_custom_limit
laborant@ubuntu-01:my_custom_limit$ echo "500M" | sudo tee memory.max
500M
laborant@ubuntu-01:my_custom_limit$ echo "1
0000 100000" | sudo tee cpu.max # 10% of CPU
10000 100000

Memory.max vs .high

sudo tee memory.max -> the moment process reaches its limit, its get killed by OOM
sudo tee memory.high -> before this limit reached, memory utilizaition will be throttled to avoid killing.

Already running process

• you can map a process to a cgroup which you created

laborant@ubuntu-01:my_custom_limit$ omnihog  > /dev/null & 
[1] 2545
laborant@ubuntu-01:my_custom_limit$ echo 2545 | sudo tee cgroup.procs
2545

Launch a shell so any new process under it get these limits applied

or you can launch new shell inside of that cgroup and then you can start the process, so that process will be applied those cgroup limits

laborant@ubuntu-01:my_custom_limit$ echo $$ | sudo tee cgroup.procs
1027
laborant@ubuntu-01:my_custom_limit$ omnihog 
[2026-10-29T12:25:30] Started a CPU hog
[2026-10-29T12:25:30] Started a CPU hog
[2026-10-29T12:25:30] Started a CPU hog
[2026-10-29T12:25:30] Started a CPU hog
[2026-10-29T12:25:31] Allocated 10 MB of memory
[2026-10-29T12:25:33] Allocated 10 MB of memory
[2026-10-29T12:25:35] Allocated 10 MB of memory
....
[2026-10-29T12:26:41] Allocated 10 MB of memory
Killed
laborant@ubuntu-01:my_custom_limit$ 

That’s it, and hope it helps.
Thank you.

azure create vm

Azure CLI Commands & Practice Workflow

1. Retrieve Resource Group Name

Query the first available resource group and output as tab-separated values (tsv) to strip quotes and extra formatting:

Bash

rg_name="$(az group list --query '[0].name' -o tsv)"

2. Create Key Vault Certificate

Create a new certificate using Azure Key Vault’s default policy:

Bash

az keyvault certificate create \
  --vault-name vaultname \
  -n cert1 \
  -p "$(az keyvault certificate get-default-policy)"

3. Retrieve Secret Version IDs

Get all enabled secret version IDs associated with the certificate:

Bash

secrets=$(az keyvault secret list-versions \
  --vault-name vaultname \
  -n cert1 \
  --query "[?attributes.enabled].id" \
  -o tsv)

4. Format Secret for VM Deployment

Format the secret ID to prepare it for attachment during VM creation:

Bash

vm_secrets=$(az vm secret format -s "$secrets")

5. Create Virtual Machine

Command Syntax

Bash

az vm create \
  -n nautilus-vm \
  -g $rg_name \
  --image Ubuntu2204 \
  --size Standard_DS2_v2 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --data-disk-sizes-gb 30 \
  --storage-sku Standard_LRS

Command Execution

Bash

az vm create \
  -n nautilus-vm \
  -g kml_rg_main-01cde7595e7b4e3e \
  --image Ubuntu2204 \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --data-disk-sizes-gb 30 \
  --storage-sku Standard_LRS

Creation Output

JSON

{
  "fqdns": "",
  "id": "/subscriptions/f0c3bcdd-5ce2-4fa0-8cf3-41559747512b/resourceGroups/kml_rg_main-01cde7595e7b4e3e/providers/Microsoft.Compute/virtualMachines/nautilus-vm",
  "location": "eastus",
  "macAddress": "00-22-48-2B-7F-E6",
  "powerState": "VM running",
  "privateIpAddress": "10.0.0.4",
  "publicIpAddress": "20.25.33.164",
  "resourceGroup": "kml_rg_main-01cde7595e7b4e3e",
  "zones": ""
}

6. List Virtual Machines (Table Output)

List all VMs with details including Power State and Provisioning State in a formatted table:

Bash

az vm list -d --query "[].{Name:name, ResourceGroup:resourceGroup, PowerState:powerState, ProvisioningState:provisioningState}" -o table