Writing a Container Runtime in Go
summary
Builds a minimal runtime in Go that uses Linux syscalls directly: clone flags for namespaces (PID, mount, UTS), chroot to swap the process root, explicit UID/GID mappings for rootless UID mapping, and cgroup file writes to enforce limits. Demonstrates a working re-exec pattern, a virtual ethernet pair with a parent/child pipe for coordination, and a successful 50-process limit that stops a fork bomb. Source code runs end-to-end and the demos prove the runtime actually isolates and restricts processes.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:19What is a container runtime
- 3:04Linux concepts for containers
- 4:31Changing root filesystem
- 7:47Namespaces for isolation
- 10:33Advanced namespace isolation
- 13:04Rootless containers
- 15:54Networking in runtimes
- 18:26Cgroups for limits
- 20:36Cgroup limits demo
- 21:39Resources and closing
related talks
23mWhat is a container, really? Let's write one in Go from scratch
24mWrite your own container, for fun and no profit!
33mLinux Container Internals
37mDocker without docker- understanding the basics
42mCan you write an OS Kernel in Go?
23mLife of a Container
01h 31mTutorial: Using Linux Primitives to Build Your Own Containers
39mContainers are Linux - but what does it mean?