What’s Under the Hood of Docker? Process Separation in the Linux kernel
summary
Claims that containers are just kernel features not VMs and demonstrates the actual calls and tools: clone/unshare/setns for namespaces, libcapng and specific capabilities like CAP_NET_RAW and CAP_NET_ADMIN, cgroups for CPU/blkio/shares and seccomp profiles to kill banned syscalls. Creates an Alpine rootfs tar.gz, mounts it via loop device, implements a toy runtime in C that uses those primitives, and pushes the code to GitHub. Live demo runs but the seccomp/DNS example fails on stage, so parts work and parts are flaky.
AI-written summary · about
chapters (31)
- 0:00Introduction
- 1:28Agenda
- 2:06Disclaimer
- 2:41What are containers
- 6:10Docker run traffic
- 6:21What does this do
- 6:50Process list
- 7:10Containers
- 7:55Janoss History
- 11:16Docker History
- 11:36Technology Capabilities
- 12:10Ping as a normal user
- 12:27The sweet bit
- 12:55CapNet Admin
- 13:32CapCal
- 14:30CapNG
- 14:43How it works
- 15:24Limitations
- 15:45Linux namespaces
- 16:06Clone command
- 17:24Child function
- 17:34System calls
- 19:20Counting math
- 19:57Create a C group
- 20:23Classification
- 21:03C Groups
- 21:26RealTime Scheduling
- 22:02Resource Limits
- 22:13BLK IO
- 23:28System call
- 24:41Cap capabilities
related talks
31mWhat’s under the hood of Docker?
01h 39mLab: Linux Container Internals
37mDocker without docker- understanding the basics
40mHow are Docker and such are implemented in the Linux Kernel?
29mA Deep Dive into Virtualized Container Technology
59mBeyond Docker Buzzwords
40mUnpacking the Container: A Deep Dive into Virtualized Container Technology
25mBuilding and Using Micro Linux Distributions for Docker