My main takeaway from this is that you can control KVM VMs with cgroups just like normal processes. I didn’t expect that.