Container Manager (cm/)

pkg/kubelet/cm/ is the kubelet's resource arbiter. It owns the cgroup hierarchy, drives the CPU manager, memory manager, device manager, topology manager, and various Linux-specific resource enforcement code. On Linux it is huge; on Windows the equivalent is much smaller and lives in pkg/kubelet/winstats/ plus parts of cm/.

What it manages

Subsystem	Path	Purpose
Cgroup driver	pkg/kubelet/cm/cgroup_manager_linux.go	Create / update / delete cgroups for the kubelet, system reserved, and per-pod cgroup. Driver is systemd or cgroupfs.
Pod-level cgroups	pkg/kubelet/cm/pod_container_manager_linux.go	One cgroup per pod, parented under kubepods.slice (with QoS sub-slices) or kubepods/<qos>/<podid>.
CPU manager	pkg/kubelet/cm/cpumanager/	Static or none policy. With static, pins guaranteed pods to specific CPU cores. State checkpointed to disk.
Memory manager	pkg/kubelet/cm/memorymanager/	NUMA-aware memory pinning for guaranteed pods.
Topology manager	pkg/kubelet/cm/topologymanager/	Coordinates CPU manager, memory manager, and device manager so a pod gets resources from the same NUMA node. Policies: none, best-effort, restricted, single-numa-node.
Device manager	pkg/kubelet/cm/devicemanager/	Talks gRPC to device plugins (GPUs, FPGAs, RDMA, …) registered through the plugin manager. Allocates devices to containers.
DRA manager	pkg/kubelet/cm/dra/	Dynamic Resource Allocation: prepares ResourceClaim allocations for containers via DRA driver kubelet plugins.
Pid limit	pkg/kubelet/cm/admission/	Enforces per-pod PID limits via cgroup pids controller.
Hugepages	pkg/kubelet/cm/util/	Pre-allocates hugepages and hands them to pods.
OOM killer scoring	pkg/kubelet/cm/container_manager_linux.go	Sets the oom_score_adj for the kubelet itself and for system services.

Boot

NewContainerManager(...) in pkg/kubelet/cm/container_manager_linux.go does:

1. Detect cgroup version (v1 vs v2). Behaviour differs in many places.
2. Verify the host has the expected cgroup controllers mounted.
3. Build the QoS cgroup tree (burstable, besteffort, guaranteed).
4. Reserve the kubelet's own cgroup (--kube-reserved, --system-reserved).
5. Build the CPU, memory, device, topology, and DRA managers.
6. Plug them all into the topology manager (which delegates allocation across them in coordinated order).

Per-container allocation

When SyncPod creates a container, the runtime call carries:

• A cpuset (from CPU manager, if static)
• A memory cgroup limit (from QoS class + container limits)
• A list of device IDs (from device manager)
• A list of DRA prepared resources (from DRA manager)
• A pid cgroup limit
• The pod's parent cgroup path

The CRI runtime applies these via LinuxContainerResources and Devices fields in runtime.proto.

Resource accounting flows

graph LR
    Spec[Pod.Spec.Containers.Resources] -->|admit| QoS[QoS classifier]
    QoS --> Cgroups[Cgroup manager]
    QoS --> Topo[Topology manager]
    Topo --> CPU[CPU manager]
    Topo --> Mem[Memory manager]
    Topo --> Dev[Device manager]
    Topo --> DRA[DRA manager]
    CPU --> Runtime
    Mem --> Runtime
    Dev --> Runtime
    DRA --> Runtime
    Runtime[CRI runtime] --> Container

Eviction integration

Container Manager exposes the cgroup hierarchy that the eviction manager (pkg/kubelet/eviction/) uses to compute pressure signals:

• memory.available
• nodefs.available and nodefs.inodesFree
• imagefs.available
• pid.available

When eviction triggers, the eviction manager picks the worst-offending pod (by usage above request, then QoS class), and sends it through the same lifecycle path as a normal delete.

Key source files

File	Purpose
pkg/kubelet/cm/container_manager.go	Cross-platform interface
pkg/kubelet/cm/container_manager_linux.go	Linux implementation
pkg/kubelet/cm/container_manager_windows.go	Windows stub
pkg/kubelet/cm/cgroup_manager_linux.go	Cgroup driver (systemd vs cgroupfs)
pkg/kubelet/cm/cpumanager/cpu_manager.go	CPU manager
pkg/kubelet/cm/memorymanager/memory_manager.go	Memory manager
pkg/kubelet/cm/devicemanager/manager.go	Device manager
pkg/kubelet/cm/topologymanager/topology_manager.go	Topology coordinator
pkg/kubelet/cm/dra/manager.go	DRA integration