# Cgroups all the way down

DevFeed: [Cgroups all the way down](<https://devfeed.tech/articles/cgroups-all-the-way-down-35153.md>)

Original publisher: [Read original article](<https://blog.jessfraz.com/post/cgroups-all-the-way-down/>)

Published: 2015-10-02T18:47:47Z

Content type: article

Language: en

Sources: [Jessie Frazelle](<https://devfeed.tech/sources/jessie-frazelle.md>)

Topics: [Compression](<https://devfeed.tech/topics/compression.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [container](<https://devfeed.tech/topics/container.md>), [Bash](<https://devfeed.tech/topics/bash.md>)

Tags: [bash](<https://devfeed.tech/tags/bash.md>), [compression](<https://devfeed.tech/tags/compression.md>), [container](<https://devfeed.tech/tags/container.md>), [debian](<https://devfeed.tech/tags/debian.md>), [docker](<https://devfeed.tech/tags/docker.md>)

## AI overview

The article connects decompression bombs with Linux cgroup block-device bandwidth limits. It demonstrates using Docker's --read-bps-device option to limit a container's device read rate to 1 MB per second and verify the limit with dd.

## Source excerpt

I went to a meetup recently where a talk was given by Cara Marie of the NCC Group. She talked about decompression bombs and the various compression algorithms that can create these malicious artifacts. You might be familiar with Russ Cox's post Zip Files All The Way Down, which goes over self-reproducing zip files. However most programs will not decompress the files fromm his blog post recursively. Which just leaves us with the problem of the more sofisticated decompression bomb. During the talk, I couldn't help but think about how we recently got a pull request to Add support for blkio read/write bps device. Granted, this does not control disk space utilization, BUT it does allow for throttling the upper limit on write/read to the device. Let me give an example of how this works. # lets set read-bps-device to 1MB/second # this will set a limit on the bandwidth rate of that device # to 1MB/second $ docker run --rm -it --read-bps-device /dev/zero:1mb debian:jessie bash # now we are in the container, lets test that the cgroup is working correctly $ dd if=/dev/zero of=/dev/null bs=4K count=1024 iflag=direct 1024+0 records in 1024+0 records out 4194304 bytes (4.2 MB) copied, 4.0001 s, 1.0 MB/s # pretty cool right?