cgroups are the backbone of container resource isolation in kubernetes. understanding how they work, and where they fail, is essential for building secure clusters.