You put processes into a cgroup and then set rules for the group: a maximum amount of memory, a share of CPU time, a cap on the number of processes or limits on disk activity. The kernel enforces these limits. If a group goes over its memory limit, the kernel can kill a process in it, and this is how containers are kept from taking all of the host's memory.
systemd uses cgroups to run services, so settings such as MemoryMax and CPUQuota in a unit file become cgroup limits. Docker and Kubernetes rely on the same mechanism for container limits.
Compared with older per-process limits such as RLIMIT_AS, cgroups apply to a whole group, including all its children, and measure real memory use instead of address space. That makes them better suited to capping a web server pool.
For a public service, giving the web workers a cgroup with a memory ceiling means that a runaway or exploited process can fail on its own and not drag the server down with it.