rkt Deep Dive
summary
Explains how rkt actually runs containers: rkt uses a pre-mount cgroup tree strategy so systemd in stage1 manages per-app cgroups with only selected subpaths writable; OCI/Docker images are fetched via docker->ACI conversion and render-to-tree store (layers are squashed at download, then overlayfs provides container COW), not stacked runtime layers; security uses a tested seccomp whitelist plus device-cgroup rules and bind-hiding of /dev entries; container readiness uses sd_notify across namespaces conveyed from the in-container systemd to the host.
AI-written summary · about
chapters (9)
- 0:00Intro
- 2:00C Group Tree
- 8:38OCI Images
- 11:00OCI Specification
- 17:00Dependencies
- 21:50Flags
- 22:30Containers
- 24:05System
- 30:50filesystem
