What’s under the hood of Docker?
summary
Explains how Docker composes Linux features into real isolation: namespaces via clone/unshare/setns, cgroups for CPU/memory/io limits (cpuset example and real-memory limits to avoid host OOM), capabilities using libcap/capng (cap_net_admin needed for OpenVPN), containerd shim and how a container looks like one process (traffic reverse proxy example), seccomp profile and apparmor usage, a small C/C++ runtime built that runs an Alpine tar image — demo mostly works though the capabilities snippet misbehaves.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:58Agenda
- 1:55Disclaimer
- 2:31Hardware
- 5:54Linux Kernel attributes
- 7:23Virtualization vs Containerization
- 9:49Process List
- 11:18History
- 13:19Recommendation
- 14:27Capnet Admin
- 15:31Capnet Capabilities
- 16:32Example Program
- 18:38Chat Function
- 18:53Set NS
- 20:19C groups
- 21:40Shares
- 24:15AppArmor
- 24:46Demo
- 29:44Mythbusters
related talks
30mWhat’s Under the Hood of Docker? Process Separation in the Linux kernel
01h 39mLab: Linux Container Internals
37mDocker without docker- understanding the basics
40mHow are Docker and such are implemented in the Linux Kernel?
59mBeyond Docker Buzzwords
31mYour Containers Aren’t Alone: Demystifying Container Isolation
29mA Deep Dive into Virtualized Container Technology
50mThe state of container security