cgroups v2 on the host: checking the mode and reading per-unit resource limits

Goal

Confirm which cgroup mode a Linux host is running in and inspect the resource limits systemd (and, through it, container runtimes) apply to a specific unit or container.

Prerequisites

Shell access; root not required for read-only inspection, but needed to view some other users' cgroup details.

Steps

1. Check the mode: stat -fc %T /sys/fs/cgroup. The kernel's cgroup v2 documentation mounts the unified hierarchy as filesystem type cgroup2, which stat reports as cgroup2fs; that output means the host is fully on cgroup v2 (unified mode). Seeing tmpfs there instead means a hybrid or legacy (cgroup v1) setup, where /sys/fs/cgroup is a tmpfs with separate v1 controller mounts underneath.
2. Browse the tree as a hierarchy of slices, scopes and services: systemd-cgls prints the whole cgroup tree with the process(es) under each unit; systemd-cgls /system.slice/docker.service (or the relevant slice) narrows it to one branch.
3. Watch live resource use per cgroup: systemd-cgtop shows tasks, CPU, memory and I/O per control group, refreshing like top; useful for spotting which container or service is consuming a host's resources without knowing its PID in advance.
4. Read a systemd unit's configured limits directly: systemctl show <unit> --property=MemoryMax,MemoryHigh,CPUQuotaPerSecUSec. A Podman Quadlet container runs under its service unit; a docker run --memory=512m container with the systemd cgroup driver (the usual default on cgroup v2) becomes a docker-<id>.scope under system.slice — with the cgroupfs driver it sits under /sys/fs/cgroup/docker/<id>/ instead. Either way, read memory.max and cpu.max in that directory for the raw kernel-enforced values (max means unlimited).
5. Correlate a container to its cgroup path: systemctl status <container-unit> (Quadlet/systemd-managed), or take the container's main PID (docker inspect --format '{{.State.Pid}}' <container>) and read /proc/<pid>/cgroup, whose single 0::<path> line on cgroup v2 is the path relative to /sys/fs/cgroup. (.HostConfig.CgroupParent is usually empty; it only shows an explicitly set parent.)

Expected result

stat -fc %T /sys/fs/cgroup reports cgroup2fs; systemd-cgtop and systemd-cgls show the expected unit tree with live figures matching what the container runtime reports through its own stats commands.

Limits and test basis

The path and exact controller file names (memory.max, cpu.max, etc.) are the unified-hierarchy names documented in the kernel's cgroup-v2 admin guide; a host still on legacy cgroup v1 exposes different, per-controller file names and different limits knobs (memory.limit_in_bytes), which this article does not cover.