@@ -498,19 +498,23 @@ func (b *Builder) create() (*daemon.Container, error) {

 	}

 	b.runConfig.Image = b.image

-	// TODO: why not embed a hostconfig in builder?

-	hostConfig := &runconfig.HostConfig{

+	resources := runconfig.Resources{

+		CgroupParent: b.CgroupParent,

 		CPUShares:    b.CPUShares,

 		CPUPeriod:    b.CPUPeriod,

 		CPUQuota:     b.CPUQuota,

 		CpusetCpus:   b.CPUSetCpus,

 		CpusetMems:   b.CPUSetMems,

-		CgroupParent: b.CgroupParent,

 		Memory:       b.Memory,

 		MemorySwap:   b.MemorySwap,

-		ShmSize:      b.ShmSize,

 		Ulimits:      b.Ulimits,

-		Isolation:    b.Isolation,

+	}

+

+	// TODO: why not embed a hostconfig in builder?

+	hostConfig := &runconfig.HostConfig{

+		Isolation: b.Isolation,

+		ShmSize:   b.ShmSize,

+		Resources: resources,

 	}

 	config := *b.runConfig

@@ -22,7 +22,7 @@ func TestAdjustCPUShares(t *testing.T) {

 	}

 	hostConfig := &runconfig.HostConfig{

-		CPUShares: linuxMinCPUShares - 1,

+		Resources: runconfig.Resources{CPUShares: linuxMinCPUShares - 1},

 	}

 	daemon.adaptContainerSettings(hostConfig, true)

 	if hostConfig.CPUShares != linuxMinCPUShares {

@@ -60,7 +60,7 @@ func TestAdjustCPUSharesNoAdjustment(t *testing.T) {

 	}

 	hostConfig := &runconfig.HostConfig{

-		CPUShares: linuxMinCPUShares - 1,

+		Resources: runconfig.Resources{CPUShares: linuxMinCPUShares - 1},

 	}

 	daemon.adaptContainerSettings(hostConfig, false)

 	if hostConfig.CPUShares != linuxMinCPUShares-1 {

@@ -165,6 +165,28 @@ type LogConfig struct {

 	Config map[string]string

 }

+// Resources contains container's resources (cgroups config, ulimits...)

+type Resources struct {

+	// Applicable to all platforms

+	CPUShares int64 `json:"CpuShares"` // CPU shares (relative weight vs. other containers)

+

+	// Applicable to UNIX platforms

+	CgroupParent      string // Parent cgroup.

+	BlkioWeight       uint16 // Block IO weight (relative weight vs. other containers)

+	BlkioWeightDevice []*blkiodev.WeightDevice

+	CPUPeriod         int64            `json:"CpuPeriod"` // CPU CFS (Completely Fair Scheduler) period

+	CPUQuota          int64            `json:"CpuQuota"`  // CPU CFS (Completely Fair Scheduler) quota

+	CpusetCpus        string           // CpusetCpus 0-2, 0,1

+	CpusetMems        string           // CpusetMems 0-2, 0,1

+	Devices           []DeviceMapping  // List of devices to map inside the container

+	KernelMemory      int64            // Kernel memory limit (in bytes)

+	Memory            int64            // Memory limit (in bytes)

+	MemoryReservation int64            // Memory soft limit (in bytes)

+	MemorySwap        int64            // Total memory usage (memory + swap); set `-1` to disable swap

+	MemorySwappiness  *int64           // Tuning container memory swappiness behaviour

+	Ulimits           []*ulimit.Ulimit // List of ulimits to be set in the container

+}

+

 // HostConfig the non-portable Config structure of a container.

 // Here, "non-portable" means "dependent of the host we are running on".

 // Portable information *should* appear in Config.

@@ -172,7 +194,6 @@ type HostConfig struct {

 	// Applicable to all platforms

 	Binds           []string      // List of volume bindings for this container

 	ContainerIDFile string        // File (path) where the containerId is written

-	CPUShares       int64         `json:"CpuShares"` // CPU shares (relative weight vs. other containers)

 	LogConfig       LogConfig     // Configuration of the logs for this container

 	NetworkMode     NetworkMode   // Network mode to use for the container

 	PortBindings    nat.PortMap   // Port mapping between the exposed port (container) and the host

@@ -181,41 +202,30 @@ type HostConfig struct {

 	VolumesFrom     []string      // List of volumes to take from other container

 	// Applicable to UNIX platforms

-	BlkioWeight       uint16 // Block IO weight (relative weight vs. other containers)

-	BlkioWeightDevice []*blkiodev.WeightDevice

-	CapAdd            *stringutils.StrSlice // List of kernel capabilities to add to the container

-	CapDrop           *stringutils.StrSlice // List of kernel capabilities to remove from the container

-	CgroupParent      string                // Parent cgroup.

-	CPUPeriod         int64                 `json:"CpuPeriod"` // CPU CFS (Completely Fair Scheduler) period

-	CPUQuota          int64                 `json:"CpuQuota"`  // CPU CFS (Completely Fair Scheduler) quota

-	CpusetCpus        string                // CpusetCpus 0-2, 0,1

-	CpusetMems        string                // CpusetMems 0-2, 0,1

-	Devices           []DeviceMapping       // List of devices to map inside the container

-	DNS               []string              `json:"Dns"`        // List of DNS server to lookup

-	DNSOptions        []string              `json:"DnsOptions"` // List of DNSOption to look for

-	DNSSearch         []string              `json:"DnsSearch"`  // List of DNSSearch to look for

-	ExtraHosts        []string              // List of extra hosts

-	GroupAdd          []string              // List of additional groups that the container process will run as

-	IpcMode           IpcMode               // IPC namespace to use for the container

-	KernelMemory      int64                 // Kernel memory limit (in bytes)

-	Links             []string              // List of links (in the name:alias form)

-	Memory            int64                 // Memory limit (in bytes)

-	MemoryReservation int64                 // Memory soft limit (in bytes)

-	MemorySwap        int64                 // Total memory usage (memory + swap); set `-1` to disable swap

-	MemorySwappiness  *int64                // Tuning container memory swappiness behaviour

-	OomKillDisable    bool                  // Whether to disable OOM Killer or not

-	PidMode           PidMode               // PID namespace to use for the container

-	Privileged        bool                  // Is the container in privileged mode

-	PublishAllPorts   bool                  // Should docker publish all exposed port for the container

-	ReadonlyRootfs    bool                  // Is the container root filesystem in read-only

-	SecurityOpt       []string              // List of string values to customize labels for MLS systems, such as SELinux.

-	Ulimits           []*ulimit.Ulimit      // List of ulimits to be set in the container

-	UTSMode           UTSMode               // UTS namespace to use for the container

-	ShmSize           int64                 // Total shm memory usage

+	CapAdd          *stringutils.StrSlice // List of kernel capabilities to add to the container

+	CapDrop         *stringutils.StrSlice // List of kernel capabilities to remove from the container

+	DNS             []string              `json:"Dns"`        // List of DNS server to lookup

+	DNSOptions      []string              `json:"DnsOptions"` // List of DNSOption to look for

+	DNSSearch       []string              `json:"DnsSearch"`  // List of DNSSearch to look for

+	ExtraHosts      []string              // List of extra hosts

+	GroupAdd        []string              // List of additional groups that the container process will run as

+	IpcMode         IpcMode               // IPC namespace to use for the container

+	Links           []string              // List of links (in the name:alias form)

+	OomKillDisable  bool                  // Whether to disable OOM Killer or not

+	PidMode         PidMode               // PID namespace to use for the container

+	Privileged      bool                  // Is the container in privileged mode

+	PublishAllPorts bool                  // Should docker publish all exposed port for the container

+	ReadonlyRootfs  bool                  // Is the container root filesystem in read-only

+	SecurityOpt     []string              // List of string values to customize labels for MLS systems, such as SELinux.

+	UTSMode         UTSMode               // UTS namespace to use for the container

+	ShmSize         int64                 // Total shm memory usage

 	// Applicable to Windows

 	ConsoleSize [2]int         // Initial console size

 	Isolation   IsolationLevel // Isolation level of the container (eg default, hyperv)

+

+	// Contains container's resources (cgroups, ulimits)

+	Resources

 }

 // DecodeHostConfig creates a HostConfig based on the specified Reader.

@@ -323,6 +323,24 @@ func Parse(cmd *flag.FlagSet, args []string) (*Config, *HostConfig, *flag.FlagSe

 		return nil, nil, cmd, err

 	}

+	resources := Resources{

+		CgroupParent:      *flCgroupParent,

+		Memory:            flMemory,

+		MemoryReservation: MemoryReservation,

+		MemorySwap:        memorySwap,

+		MemorySwappiness:  flSwappiness,

+		KernelMemory:      KernelMemory,

+		CPUShares:         *flCPUShares,

+		CPUPeriod:         *flCPUPeriod,

+		CpusetCpus:        *flCpusetCpus,

+		CpusetMems:        *flCpusetMems,

+		CPUQuota:          *flCPUQuota,

+		BlkioWeight:       *flBlkioWeight,

+		BlkioWeightDevice: flBlkioWeightDevice.GetList(),

+		Ulimits:           flUlimits.GetList(),

+		Devices:           deviceMappings,

+	}

+

 	config := &Config{

 		Hostname:     hostname,

 		Domainname:   domainname,

@@ -349,25 +367,13 @@ func Parse(cmd *flag.FlagSet, args []string) (*Config, *HostConfig, *flag.FlagSe

 	}

 	hostConfig := &HostConfig{

-		Binds:             binds,

-		ContainerIDFile:   *flContainerIDFile,

-		Memory:            flMemory,

-		MemoryReservation: MemoryReservation,

-		MemorySwap:        memorySwap,

-		KernelMemory:      KernelMemory,

-		CPUShares:         *flCPUShares,

-		CPUPeriod:         *flCPUPeriod,

-		CpusetCpus:        *flCpusetCpus,

-		CpusetMems:        *flCpusetMems,

-		CPUQuota:          *flCPUQuota,

-		BlkioWeight:       *flBlkioWeight,

-		BlkioWeightDevice: flBlkioWeightDevice.GetList(),

-		OomKillDisable:    *flOomKillDisable,

-		MemorySwappiness:  flSwappiness,

-		Privileged:        *flPrivileged,

-		PortBindings:      portBindings,

-		Links:             flLinks.GetAll(),

-		PublishAllPorts:   *flPublishAll,

+		Binds:           binds,

+		ContainerIDFile: *flContainerIDFile,

+		OomKillDisable:  *flOomKillDisable,

+		Privileged:      *flPrivileged,

+		PortBindings:    portBindings,

+		Links:           flLinks.GetAll(),

+		PublishAllPorts: *flPublishAll,

 		// Make sure the dns fields are never nil.

 		// New containers don't ever have those fields nil,

 		// but pre created containers can still have those nil values.

@@ -382,19 +388,17 @@ func Parse(cmd *flag.FlagSet, args []string) (*Config, *HostConfig, *flag.FlagSe

 		IpcMode:        ipcMode,

 		PidMode:        pidMode,

 		UTSMode:        utsMode,

-		Devices:        deviceMappings,

 		CapAdd:         stringutils.NewStrSlice(flCapAdd.GetAll()...),

 		CapDrop:        stringutils.NewStrSlice(flCapDrop.GetAll()...),

 		GroupAdd:       flGroupAdd.GetAll(),

 		RestartPolicy:  restartPolicy,

 		SecurityOpt:    flSecurityOpt.GetAll(),

 		ReadonlyRootfs: *flReadonlyRootfs,

-		Ulimits:        flUlimits.GetList(),

 		LogConfig:      LogConfig{Type: *flLoggingDriver, Config: loggingOpts},

-		CgroupParent:   *flCgroupParent,

 		VolumeDriver:   *flVolumeDriver,

 		Isolation:      IsolationLevel(*flIsolation),

 		ShmSize:        parsedShm,

+		Resources:      resources,

 	}

 	// When allocating stdin in attached mode, close stdin at client disconnect