cgroup namespace
also: CLONE_NEWCGROUP, cgroupns
A Linux namespace that isolates a process's view of cgroups, allowing it to see only the cgroups within its own namespace hierarchy rather than the system-wide cgroup tree.
Cgroup namespaces (CLONE_NEWCGROUP) provide resource limitation isolation by restricting a process's visibility of the cgroup hierarchy. A process in a cgroup namespace sees itself as being in the root of its own cgroup tree, even if it's actually nested deeper in the system's overall hierarchy.
This is particularly useful in containerization: a container can have its own isolated view of cgroups, preventing processes inside from discovering the container's actual resource limits or sibling containers. For example, a process in a Docker container might see /cgroup/memory as its root, when the actual path is /cgroup/docker/container-id/memory.
Cgroup namespaces work in conjunction with other namespaces (pid, network, etc.) and cgroups themselves. They don't enforce resource limits—cgroups do that—but rather hide the broader cgroup infrastructure from the isolated process.