Understand your New School (containerized) Operating System
summary
Compares Linux containers (namespaces, cgroups, capabilities) with full VMs and demos chroot, Docker, QEMU/KVM; shows PID 1, entropy and fork‑bomb side effects, and why containerized apps share kernel faults. Gives concrete measurements and choices: 200 VMs on one server and orchestration that boots VMs in ~7 second VM boot intervals, explains that Docker for Mac runs inside a VM, and warns shared kernel = shared risk so production third‑party workloads often run in VMs.
AI-written summary · about
chapters (15)
- 0:00Intro
- 8:11Security
- 17:51Runtime
- 19:06Namespace
- 21:36Process
- 26:30C Groups
- 28:34Neighborhood
- 31:59Kernel
- 34:50PID
- 38:42Emulation
- 41:34Zen
- 42:42Virtual transaction in friction
- 43:54Access to hardware
- 46:27Launching virtual machines
- 50:00Docker for Mac
related talks
31mWhat’s under the hood of Docker?
47mContainer Security
08mInterview
50mThe state of container security
14mA kernel? In a Container? Explain Yourself!
31mYour Containers Aren’t Alone: Demystifying Container Isolation
38mOn the Way to Safe Containers
34mContainer Runtimes... on Lockdown: The Hidden Costs of Multi-tenant Workloads