Use cgroups to limit the resources a virtual container can consume to prevent oversubscription and contention.