Linux 5.7 To Support Spawning A Process In A Different Cgroup From Its Parent

An important infrastructure change with the Linux 5.7 kernel now allows the ability to create a process in a different cgroup from the parent process.

Using the clone3 system call, a child process can now be spawned directly into a different cgroup compared to its parent. This is a big efficiency improvement as a write lock no longer needs to be acquired for the cgroup_threadgroup_rwsem global lock that makes migrating tasks/threads "super expensive" plus other benefits outlined in the patch include:

This adds support for creating a process in a different cgroup than its parent. Callers can limit and account processes and threads right from the moment they are spawned:

- A service manager can directly spawn new services into dedicated cgroups.
- A process can be directly created in a frozen cgroup and will be frozen as well.
- The initial accounting jitter experienced by process supervisors and daemons is eliminated with this.
- Threaded applications or even thread implementations can choose to create a specific cgroup layout where each thread is spawned directly into a dedicated cgroup.

This support for spawning directly into different cgroups from the clone3 system call has been undergoing several rounds of review in recent months. The support has landed in Linux 5.7 as part of the cgroup changes.