Docker Engine 20.10+ cgroup v2 Memory Limit Enforcement

cgroup v2 Memory Limit Enforcement in Docker Engine 20.10+

Docker Engine 20.10 introduced cgroup v2 support, fundamentally changing how memory limits are enforced within containers. The transition from cgroup v1's hierarchical memory accounting to cgroup v2's unified memory model affects OOM killer activation, memory pressure notifications, and limit granularity.

Key differences include cgroup v2's memory.low and memory.high settings for proactive throttling versus v1's hard memory.limit_in_bytes enforcement. Hybrid environments with mixed cgroup v1/v2 workloads may experience inconsistent memory behavior where containers exceed limits before triggering OOM conditions.

The memory leak in docker-proxy was resolved in version 20.10.11 through connection tracking improvements, but the underlying cgroup v2 memory accounting differences persist across versions. BuildKit's memory management through BUILDKIT_STEP_MAX_MEMORY operates independently of container runtime memory controls.

Organizations upgrading to Docker Engine 20.10+ need to understand whether their existing memory limit configurations will behave identically under cgroup v2, particularly in environments where some containers still operate under cgroup v1 while others use the new unified hierarchy.

Has the cgroup v2 memory enforcement behavior been validated against existing container memory limit configurations, and what specific behavioral differences should be expected when transitioning production workloads from cgroup v1 to cgroup v2 in Docker Engine 20.10+?