Containers from zero! An overview of cgroup and name-spaces
summary
Builds a minimal container from scratch by creating PID and network namespaces, connecting two namespaces with a veth pair (red and blue), and moving processes into a cgroup. Uses unshare, nsenter, and small Go programs to spawn processes, assign IPs and show pinging, and enforces a cgroup v2 memory limit of 100 MB to throttle an allocator. Demonstrates remaining host leaks: root can kill alias PIDs and container mounts are accessible via /proc, so the prototype works but isn’t production-ready.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:55What is a container
- 5:05Namespaces and process isolation
- 9:02PID namespace creation
- 18:21Network namespace isolation
- 23:49Cgroups and resource isolation
- 27:18Cgroup v2 demo
- 30:31Combining namespaces and cgroups
- 33:25Creating namespaces in Go
- 35:37Docker filesystem isolation
- 37:26Entering container with NSEnter
- 39:14Conclusion
- 41:03Q&A
related talks
23mLife of a Container
49mContainers without Docker
37mDeep Dive into Docker Containers for Rails Developers
34mPod Through a Magnifying Glass
34mThe beauty of virtual infrastructure with K8s and containers
40mUser Namespaces in Kubernetes: Security and Flexibility - Pick Both
38mEverything you don't want to know about privileged containers
25mIsolate the Users! Supporting User Namespaces in K8s for Increased Security