Exploring Container Mechanisms Through the Story of a Syscall
summary
Follows a single open() syscall inside a container to show the exact kernel subsystems and sequence involved: path lookup in the container mount namespace, overlayfs copy-on-write behavior, SELinux LSM authorization, capability checks, and seccomp-bpf filtering. Uses kernel tracing tools (ftrace and BPF), small container images and varied pod specs to reproduce and demonstrate an unexpected interaction between overlayfs COW and inode/UID semantics, and provides working demo commands.
AI-written summary · about
chapters (6)
- 0:00Container mechanisms intro
- 7:06Container basics
- 12:00Linux compatibility
- 16:17Security context
- 22:17Google tools stats
- 25:31Q&A
related talks
33mLinux Container Internals
23mLife of a Container
50mImproving Container Security with System Call Interception
50mThe state of container security
01h 31mTutorial: Using Linux Primitives to Build Your Own Containers
01h 32mContainers – A Look Under the Hood
48mUnderstanding Container Engines by Demo™
48mState of Linux Kernel Container Features