Tutorial: Using Linux Primitives to Build Your Own Containers

on YouTube ↗01h 31m

" summary

Step-by-step build of a container from kernel primitives: create user namespaces and remap UIDs so root inside ≠ root outside, unshare mount and pivot_root to give a new filesystem view, apply seccomp notifier to block or emulate dangerous syscalls (demoed by blocking mknod), drop capabilities, load an LSM profile (AppArmor) and enforce resource limits with cgroups (v1 vs cgroup v2 incompatibility shown). Demos prove ordering matters, unprivileged containers work without host escapes unless a kernel bug exists, and the mknod interception lets safe device access.

AI-written summary · about

" chapters (11)

1. 0:00Introduction
2. 4:37General Considerations
3. 6:17File System Isolation
4. 10:53namespaces
5. 21:38seccomp
6. 28:08Demo
7. 32:03Capabilities
8. 37:53User Namespace
9. 45:03Loading Profiles
10. 48:16C Groups
11. 55:51Proxy Groups

" related talks

• 01h 32mContainers – A Look Under the HoodGerlof Langeveld · ContainerCon @ Open Source Summit Europe 2022
• 33mLinux Container InternalsGreat Umegbewe · Kubernetes Community Days Africa 2022
• 48mState of Linux Kernel Container FeaturesChristian Brauner, Stephane Graber · LinuxCon @ OSS NA 2023
• 42mSecuring Filesystem Images for Unprivileged ContainersJames Bottomley · Linux Security Summit 2016
• 31mLet's Build And Break A Container By Hand Without Docker Or LXCReinhard Kugler · sec4dev 2021
• 23mLife of a ContainerIndradhanush Gupta · Kubernetes Forum Delhi 2020
• 50mUnderstanding Linux Containers by Building One from ScratchAlessio Coltellacci · Voxxed Days Luxembourg 2018
• 39mContainers are Linux - but what does it mean?Tomáš Kašpárek, Jan Zmeškal · DevConf.CZ 2021