Containers are Linux - but what does it mean?
summary
Shows how to run a real container using only Linux primitives: chroot + unshare + mount, plus mounting /proc and using bind mounts. Demonstrates running python -m http.server from a fedora tar rootfs, then exposes problems (can see and kill host processes until a new PID namespace gives PID 1). Walks through UTS hostname isolation, creating a PID namespace with unshare -b -f and remounting /proc, and limiting memory by creating /sys/fs/cgroup/memory/defconf and writing memory.limit_in_bytes and tasks.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:58extract the archive
- 7:58run a container
- 11:14run a very simple http server
- 15:26kill system processes from the container
- 18:37isolate hostname of the machine
- 22:40enter already existing namespaces
related talks
01h 32mContainers – A Look Under the Hood
23mLife of a Container
33mLinux Container Internals
01h 31mTutorial: Using Linux Primitives to Build Your Own Containers
24mWrite your own container, for fun and no profit!
37mDocker without docker- understanding the basics
49mThings I Wish I Had Learned Earlier About Containers: Lessons from a Seasoned Linux...
01h 15mLinux containers in (less than) 100 lines of shell