It's already intended to help prevent runaway resource consumption, and I don't know how it plays with cgroups (maybe other folks here have input?)