cgroups

Containers share a kernel with the code they run, the wrong boundary for code you did not write. gVisor, Firecracker microVMs and full VMs each buy a stronger one at a cost in memory, start time and GPU access. The overhead arithmetic that turns 50,000 sessions into a host count, and the tiered design.

Slurm's GPU path is four pieces: GRES declares the devices, a partition groups nodes with limits, the batch script asks for a shape, and cgroups confine the job to its GPUs. The script that gets eight GPUs on one node, the flags that scatter them across eight nodes, and how ranks find their GPU.