bk99.de entertain the web since 1997

bk99.de
HN · ContainersCurated

Linux containers in 500 lines of code

Summary

Liz Rice builds a small container in Go and makes namespaces, cgroups, the root file system and process start directly visible in the code. The example comprises about 500 lines of Go. It uses Linux-specific system calls.

Ideas

  • clone starts a process in new Linux namespaces.
  • UTS and PID namespaces separate host names and process IDs.
  • A separate root file system limits the visible file hierarchy.
  • Cgroups restrict resources outside the isolated process tree.

Insights

  • Containers arise from several kernel mechanisms, not from a single container function.
  • Isolation and resource limits solve different problems.
  • Short teaching code shows trust boundaries more clearly than large production tools.

Facts

  • A container shares the kernel with its host.

Recommendations

  • Only run the teaching container on an expendable test system.
  • Check namespaces, capabilities and cgroups as separate layers of protection.

References

Read the original article

Search the Web Archive

HN · 2025

Apple Container: Linux containers on macOS

Apple develops a Swift-based runtime that starts Linux containers in lightweight virtual machines on Apple Silicon. Apple publishes the project under the Apache 2.0 licence. The tool targets Apple Silicon Macs and uses Linux guest kernels.

HN · 2023

Go, containers and the Linux scheduler

River Phillips shows how unrecognised container CPU limits worsen Go garbage collection and application latency. The test container was given a quota of four CPUs. Adjusting GOMAXPROCS shortened the GC cycle from about 2.5 to under one millisecond.

HN · 2017

LinuxKit builds small Linux systems for containers

Docker presents LinuxKit as a toolkit for minimal, immutable and reproducible Linux images on different platforms. LinuxKit was presented at DockerCon in 2017. The project is licensed under an Apache licence.