Write your own container, for fun and no profit!

on YouTube ↗24m

" summary

Shows how to build a minimal container in Rust by combining chroot with Linux namespaces and cgroups, using the clone/unshare/setns syscalls to create new PID namespace and mount and network views so the child starts as PID 1. Demonstrates enforcing limits by writing to the cgroup files (e.g. cgroups pid.max), explains the mmap/oom behavior, and runs a tiny demo that isolates a process successfully though the live demo is brief.

AI-written summary · about

" chapters (11)

1. 0:00Start
2. 0:13FOLLOW THE SLIDES: TINY.CC/FUN- CONTAINERS
3. 0:50WHAT EVEN IS A SYSTEMS PROGRAMMING LANGUAGE?
4. 2:02A SYSTEM PROGRAM IS AN INTEGRATED SET OF SUBPROGRAMS... EXCEEDING SOME THRESHOLD OF SIZE AND/OR COMPLEXITY.
5. 5:151990s: RISE OF SCRIPTING LANGUAGES
6. 6:412010s: BOUNDARIES BLUR
7. 7:45WHAT IS A SYSTEMS PROGRAMMING LANGUAGE TODAY?
8. 9:04WHERE DOES RUST SHINE?
9. 9:47WRITING OUR OWN
10. 10:58PROCESSES BORN FROM TARBALLS ANCHORED TO NAMESPACES
11. 11:27DECONSTRUCTING THE CONTAINER

" related talks

• 23mWhat is a container, really? Let's write one in Go from scratchLiz Rice · Golang UK 2016
• 01h 31mTutorial: Using Linux Primitives to Build Your Own ContainersChristian Brauner, Stephane Graber · Linux Security Summit Europe 2019
• 23mLife of a ContainerIndradhanush Gupta · Kubernetes Forum Delhi 2020
• 33mLinux Container InternalsGreat Umegbewe · Kubernetes Community Days Africa 2022
• 39mContainers are Linux - but what does it mean?Tomáš Kašpárek, Jan Zmeškal · DevConf.CZ 2021
• 01h 32mContainers – A Look Under the HoodGerlof Langeveld · ContainerCon @ Open Source Summit Europe 2022
• 22mWriting a Container Runtime in GoMichael Duren · Commit Your Code 2026
• 31mLet's Build And Break A Container By Hand Without Docker Or LXCReinhard Kugler · sec4dev 2021