What is the underlying technology that allows containers to be restricted to defined limits for system resource usage such as CPU, memory, and network bandwidth?

'climits' is not a recognized Linux kernel feature or technology responsible for enforcing resource limits on containers.

UnionFS provides the layered filesystem capabilities for containers, allowing multiple directories to appear as one, but it does not control resource usage like CPU or memory.

Namespaces are a Linux kernel feature that provides process isolation for containers (e.g., PID, network, mount namespaces), but they do not directly limit resource usage such as CPU or memory.

Cgroups (control groups) is a fundamental Linux kernel feature that enables the allocation, prioritization, and limitation of system resources like CPU, memory, and network I/O for collections of processes, making it essential for container resource management.