Changes compared to mod_cgroup:
- dropped dependency on libcgroup (which doesn't handle cgroup v2)
- use arbitrary group names
- work nicely with mod_apparmor (dependencies order)
- pids.max caps a vhost's concurrent requests: past the limit the request gets 429 instead of a worker. The module checks pids.current against pids.max before migrating, because the kernel enforces pids.max only on fork() inside the cgroup, never on migration into it.
- every request runs in a known cgroup, never in an implicit "/": a vhost with CGroup runs there; a vhost without one runs in DefaultCGroup; when neither is configured the worker stays where httpd started it
- Linux with cgroup v2 unified hierarchy mounted at /sys/fs/cgroup
- Non-threaded MPM (prefork or mpm-itk); the module refuses to load on worker/event because writing the worker PID to cgroup.procs migrates the whole process and would contaminate other vhosts' threads
- DefaultCGroup is server-wide (every child moves there at startup) and mandatory as soon as any vhost sets CGroup
All three are verified by httpd -t, not only at startup.
See mod_cgroupmin.conf for the directive reference and examples.