Surely you can with cgroups? Isn't that exactly what they're for?