Docker without docker- understanding the basics
summary
A tiny Go program is written that forks itself, sets Linux namespace clone flags and reexecs a child to get new UTS PID mount namespaces, then chroots into a prepared Debian rootfs and mounts /proc so ps shows only container processes — it requires root or sudo to create namespaces. The demo proves containers are kernel namespaces plus a layered filesystem; image layers come from Dockerfile RUN steps and Docker limits images to 300 layers max.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:31whoami
- 10:28The plan
- 11:19The language
- 11:52The skeleton
- 17:16Adding namespaces
- 22:44The filesystem
- 25:02Finishing it up
- 31:14Complete code available at
related talks
01h 32mContainers – A Look Under the Hood
30mWhat’s Under the Hood of Docker? Process Separation in the Linux kernel
23mWhat is a container, really? Let's write one in Go from scratch
39mContainers are Linux - but what does it mean?
31mWhat’s under the hood of Docker?
33mLinux Container Internals
24mWrite your own container, for fun and no profit!
54mContainers unplugged: Linux namespaces