diff --git a/bocker b/bocker
index 2b7d127..528de6c 100755
--- a/bocker
+++ b/bocker
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 set -o errexit -o nounset -o pipefail; shopt -s nullglob
-btrfs_path='/var/bocker';
+btrfs_path='/var/bocker'; cgroups='cpu,cpuacct,cpuset,memory'; $(cgget -h &> /dev/null) && CGX="cgexec -g $cgroups" || CGX='_='
 function bocker_check() {
 	btrfs subvolume list "$btrfs_path" | grep -qw "$1" && echo 0 || echo 1
 }; function bocker_init() { #HELP Create an image from a directory:\nBOCKER init <directory>
@@ -30,6 +30,7 @@ function bocker_check() {
 }; function bocker_rm() { #HELP Delete an image or container:\nBOCKER rm <image_id or container_id>
 	[[ "$(bocker_check "$1")" == 1 ]] && echo "No container named '$1' exists" && exit 1
 	btrfs subvolume delete "$btrfs_path/$1" > /dev/null
+	cgdelete -g $cgroups:/$1 &> /dev/null || true
 	echo "Removed: $1"
 }; function bocker_images() { #HELP List images:\nBOCKER images
 	echo -e "IMAGE_ID\t\tSOURCE"
@@ -61,7 +62,8 @@ function bocker_check() {
 	btrfs subvolume snapshot "$btrfs_path/$1" "$btrfs_path/$uuid" > /dev/null
 	echo 'nameserver 8.8.8.8' > "$btrfs_path/$uuid"/etc/resolv.conf
 	echo "$cmd" > "$btrfs_path/$uuid/$uuid.cmd"
-	ip netns exec netns_"$uuid" "unshare" -fmuip --mount-proc "chroot" \
+	cgcreate -g $cgroups:/$uuid && cgset -r cpuset.cpus=0-$(($(grep vendor_id /proc/cpuinfo | wc -l)-1)) $uuid && cgset -r cpuset.mems=0 $uuid &> /dev/null || true
+	$CGX:$uuid ip netns exec netns_"$uuid" "unshare" -fmuip --mount-proc "chroot" \
 		"$btrfs_path/$uuid" /bin/sh -c "/bin/mount -t proc proc /proc && $cmd" \
 		2>&1 | tee "$btrfs_path/$uuid/$uuid.log" || true
 	ip link del dev veth0_"$uuid"