Your solution is the correct and should actually be quite future-proof; by using systemd to control the services cgroup settings, eg. CPUQota.
Description=Virtual Distributed Ethernet
man systemd.resource-control for more useful cgroup settings in systemd.
There are two caveats to this though, which I (and possibly a few others) stumpled upon. Those caveats are really difficult to track down as there does not seem to be much easily findable information about this, which is the main reason for this answer.
CPUQuota setting is only available since systemd 213, see https://github.com/systemd/systemd/blob/master/NEWS
* The CFS CPU quota cgroup attribute is now exposed for
services. The new CPUQuota= switch has been added for this
which takes a percentage value. Setting this will have the
result that a service may never get more CPU time than the
specified percentage, even if the machine is otherwise idle.
This is for example an issue with Debian Jessie which only comes with systemd 208. As an alternative one could configure
cpu.cfs_quota_us manually using
cgset from the cgroup-bin package, eg.
sudo cgcreate -g cpu:/cpulimited
sudo cgset -r cpu.cfs_period_us=50000 cpulimited
sudo cgset -r cpu.cfs_quota_us=10000 cpulimited
sudo cgexec -g cpu:cpulimited /usr/bin/ddcommand
For the settings
cpu.cfs_quota_us to be available the Kernel needs to be compiled with config-flag
CONFIG_CFS_BANDWIDTH. Sadly the 3.16.x Kernel for Debian Jessie is not compiled with this flag by default, see this feature request.
This will be available in Debian Stretch though. One could also use the kernel from jessie-backports, which should have the flag enabled.
I hope this answer helps a few people with the same issue as me...
PS: An easy way to test wether CPUquota is working in your environment is:
$ apt-get install stress
$ systemd-run -p CPUQuota=25% --slice=stress -- stress -c <your cpu count>
and watch with
htop, the load should be spread (evenly) accross all cpus/cores, summing up to 25%.
As an alternative tool one could use cpu-limit which should be available in most distros, eg.
$ apt-get install cpulimit
$ cpulimit -l 10 -P /usr/bin/ddcommand
It works by sending
SIGCONT to the attached command to pause and resume its operation.
AFAIK it was difficult to control multiple separate/stand-alone processes simultaneously with this, in like group them together, but there might also be solution for this...