Let's Build And Break A Container By Hand Without Docker Or LXC
summary
Builds an Alpine+nginx container by hand and shows which kernel features actually isolate processes: creates a new root with unshare/pivot_root and overlayed image layers, restricts block access with a cgroups device whitelist (blocks /dev/sda1 successfully), drops privileges with POSIX capabilities and setcap/ambient bits, and isolates networking with a veth+bridge network namespace. Demonstrates real breakouts — mounting the host disk and traversing /proc file descriptors and a malicious setuid binary — and notes user namespaces are omitted so root-in-container still maps to host root.
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:00What do we need
- 4:37Mount Namespace
- 7:26Docker File System
- 9:08Device Access
- 10:28Control Groups
- 14:23User Permissions
- 17:24Capabilities
- 19:00Effective Set
- 21:15Network Namespace
- 25:25Username Space
- 27:32Container Engines
- 28:36Recap
related talks
01h 31mTutorial: Using Linux Primitives to Build Your Own Containers
01h 32mContainers – A Look Under the Hood
33mLinux Container Internals
24mWrite your own container, for fun and no profit!
01h 15mLinux containers in (less than) 100 lines of shell
31mTowards unprivileged container builds
50mUnderstanding Linux Containers by Building One from Scratch
30mRootless, Reproducible, and Hermetic: Secure Container Build Showdown