Life of a Container
summary
Explains containers as Linux primitives not magic, walking through the exact syscalls and steps used: creating network namespaces with unshare -n and IP netns bind-mount, linking them with a veth pair by create veth pair and set one end into namespace so two processes get distinct interfaces and addresses, and enforcing limits by making a cgroup directory and writing a PID into cgroup.procs — echo PID > cgroup.procs to enforce 4MB limit which kills processes that exceed it; touches capabilities and seccomp.
AI-written summary · about
chapters (5)
- 0:00Introduction
- 1:45Core container concepts
- 3:48Network namespace demo
- 13:05Cgroups and resource limiting
- 18:42Conclusion and resources
related talks
33mLinux Container Internals
01h 32mContainers – A Look Under the Hood
45mContainers from zero! An overview of cgroup and name-spaces
39mContainers are Linux - but what does it mean?
01h 31mTutorial: Using Linux Primitives to Build Your Own Containers
24mWrite your own container, for fun and no profit!
49mThings I Wish I Had Learned Earlier About Containers: Lessons from a Seasoned Linux...
26mExploring Container Mechanisms Through the Story of a Syscall