Control groups (cgroups) separate processes by groups, and attach one or more subsystems to each group:
The subsystem can restrict the resource usage of each attached group. For example, we can place our application's process into the foo cgroup, attach the memory subsystem to it, and restrict our application to using, say, 50% of the host’s memory.
There are many different subsystems, each responsible for different types of resources, such as CPU, block I/O, and network bandwidth.