A cgroup, short for control group, is a Linux kernel feature that groups processes so the system can track, limit, and isolate how they use resources such as CPU, memory, and I/O. In containerized environments, cgroups help define what belongs to a workload and how that workload is constrained on the host.
cgroups matter in cyber security because they can become part of workload identity and attestation logic. Security tools may use cgroup metadata to confirm which process tree is tied to a container or service before issuing trust, credentials, or an identity. If an attacker gains root on a node, they may be able to tamper with this evidence or move processes between control groups, making a fake workload look legitimate. Defenders use cgroups for isolation and monitoring, but they must treat cgroup-derived signals as trustworthy only when the underlying host is also trusted.