Linux Container Internals
summary
Explains that Linux containers are just processes using kernel features and demonstrates them: cgroups limit resources (cpu, memory, pids), pid namespaces isolate process ids, mount/network/user/ipc namespaces for visibility, and copy‑on‑write union filesystems to layer images. Mentions clone() syscall, capabilities and SELinux controls, and common runtimes (runc/containerd, CRI‑O, Podman, Docker using containerd). Demo builds a veth pair, moves ends into two net namespaces, assigns IPs and pings successfully; shows a unionfs merging kcd1 and pcd2 directories.
AI-written summary · about
chapters (5)
related talks
23mLife of a Container
01h 32mContainers – A Look Under the Hood
49mThings I Wish I Had Learned Earlier About Containers: Lessons from a Seasoned Linux...
01h 31mTutorial: Using Linux Primitives to Build Your Own Containers
39mContainers are Linux - but what does it mean?
26mExploring Container Mechanisms Through the Story of a Syscall
48mUnderstanding Container Engines by Demo™
24mWrite your own container, for fun and no profit!