diff --git a/infrastructure/roles/cgroups/defaults/main.yml b/infrastructure/roles/cgroups/defaults/main.yml
new file mode 100644
index 0000000..922c7f8
--- /dev/null
+++ b/infrastructure/roles/cgroups/defaults/main.yml
@@ -0,0 +1,10 @@
+---
+cgroups_cmdline_candidates:
+  - /boot/firmware/cmdline.txt
+  - /boot/cmdline.txt
+
+cgroups_required_params:
+  - cgroup_memory=1
+  - cgroup_enable=memory
+
+cgroups_reboot: true
diff --git a/infrastructure/roles/cgroups/tasks/main.yml b/infrastructure/roles/cgroups/tasks/main.yml
new file mode 100644
index 0000000..1ef16a6
--- /dev/null
+++ b/infrastructure/roles/cgroups/tasks/main.yml
@@ -0,0 +1,53 @@
+---
+- name: Find kernel cmdline file
+  ansible.builtin.stat:
+    path: "{{ item }}"
+  loop: "{{ cgroups_cmdline_candidates }}"
+  register: cmdline_stats
+
+- name: Select kernel cmdline path
+  ansible.builtin.set_fact:
+    cgroups_cmdline_path: "{{ (cmdline_stats.results | selectattr('stat.exists') | map(attribute='stat.path') | list | first) | default('') }}"
+
+- name: Fail when kernel cmdline file is missing
+  ansible.builtin.fail:
+    msg: "No kernel cmdline file found. Checked: {{ cgroups_cmdline_candidates | join(', ') }}"
+  when: cgroups_cmdline_path | length == 0
+
+- name: Read kernel cmdline
+  ansible.builtin.slurp:
+    path: "{{ cgroups_cmdline_path }}"
+  register: cmdline_raw
+
+- name: Parse kernel cmdline line
+  ansible.builtin.set_fact:
+    cgroups_cmdline_current: "{{ (cmdline_raw.content | b64decode).splitlines()[0] | default('') }}"
+
+- name: Calculate missing cgroup params
+  ansible.builtin.set_fact:
+    cgroups_missing_params: "{{ cgroups_required_params | reject('in', cgroups_cmdline_current) | list }}"
+
+- name: Update kernel cmdline when params are missing
+  ansible.builtin.copy:
+    dest: "{{ cgroups_cmdline_path }}"
+    content: "{{ cgroups_cmdline_current ~ (cgroups_missing_params | length > 0 | ternary(' ' ~ (cgroups_missing_params | join(' ')), '')) ~ '\n' }}"
+    mode: "0644"
+  register: cmdline_update
+  when: cgroups_missing_params | length > 0
+
+- name: Reboot to apply cgroup settings
+  ansible.builtin.reboot:
+    msg: "Rebooting to apply cgroup kernel parameters"
+    pre_reboot_delay: 3
+    reboot_timeout: 600
+  when: cmdline_update is changed and cgroups_reboot | bool
+
+- name: Verify cgroup kernel parameters after reboot
+  ansible.builtin.command: "cat /proc/cmdline"
+  register: proc_cmdline
+  changed_when: false
+
+- name: Fail when cgroup params are missing (reboot required)
+  ansible.builtin.fail:
+    msg: "Missing cgroup params in /proc/cmdline: {{ cgroups_required_params | reject('in', proc_cmdline.stdout) | list }}. Reboot required."
+  when: (cgroups_required_params | reject('in', proc_cmdline.stdout) | list) | length > 0