bk99.de entertain the web since 1997

bk99.de
HN · ContainersCurated

Docker basics in a hundred lines of Bash

Summary

Peter Wilmott recreates images, containers, networks and resource limits with shell commands and Linux kernel mechanisms. Bocker consists of about a hundred lines of Bash. The project requires Linux.

Ideas

  • Namespaces isolate processes, mounts, networks and host names.
  • Cgroups limit CPU and memory consumption.
  • Chroot and overlay file systems form a separate root file tree.
  • iptables and virtual Ethernet pairs connect containers to the network.

Insights

  • Containers become understandable when their kernel building blocks are visible individually.
  • Short teaching code explains concepts but is not a secure production runtime.
  • Isolation arises from several mechanisms, each with its own limits.

Facts

  • It needs numerous command line tools and root privileges.

Recommendations

  • Only run Bocker in an isolated learning environment.
  • Check namespaces, capabilities and cgroups separately.

References

Read the original article

Search the Web Archive

HN · 2017

Linux containers in 500 lines of code

Liz Rice builds a small container in Go and makes namespaces, cgroups, the root file system and process start directly visible in the code. The example comprises about 500 lines of Go. It uses Linux-specific system calls.

HN · 2014

Docker 1.0 makes containers production-ready

Docker releases version 1.0 and stabilises the image format, runtime, registry workflow and interfaces for portable Linux applications. Docker 1.0 was released in June 2014. The runtime used Linux namespaces and cgroups.

HN · 2025

Apple Container: Linux containers on macOS

Apple develops a Swift-based runtime that starts Linux containers in lightweight virtual machines on Apple Silicon. Apple publishes the project under the Apache 2.0 licence. The tool targets Apple Silicon Macs and uses Linux guest kernels.