What Is a Docker Container, Really? Namespaces, cgroups and Layers

A Docker container is not a tiny computer. This deep dive takes one container apart on a Linux machine: why it is just a process with two process IDs, how namespaces limit what it sees and cgroups limit what it uses, what a container image really is (tar layers, a JSON manifest and whiteout files), what docker run hands to dockerd, containerd, a shim and runc, why docker stop can hang for ten seconds because of the PID 1 rule, and why Docker on a Mac or Windows laptop quietly runs a Linux virtual machine. Everything here is from the Linux man pages, the OCI specs and Docker's own documentation. Chapters 0:00 Cold open 0:48 One process, two numbers 2:06 What it can use 3:08 Where its files come from 4:19 What docker run does 5:47 The process-one rule 7:01 Your laptop and the shared kernel 8:11 The whole trip Sources • Docker docs: What is a container: https://docs.docker.com/get-started/d... • namespaces(7), Linux man-pages: https://man7.org/linux/man-pages/man7... • pid_namespaces(7), Linux man-pages: https://man7.org/linux/man-pages/man7... • cgroups(7), Linux man-pages: https://man7.org/linux/man-pages/man7... • Linux kernel: Control Group v2: https://www.kernel.org/doc/html/lates... • Docker docs: Resource constraints: https://docs.docker.com/engine/contai... • OCI image-spec: layer.md (whiteout files): https://github.com/opencontainers/ima... • OCI image-spec: manifest.md: https://github.com/opencontainers/ima... • Docker docs: OverlayFS storage driver: https://docs.docker.com/engine/storag... • Docker docs: containerd image store: https://docs.docker.com/engine/storag... • containerd: runtime v2 and shims: https://github.com/containerd/contain... • runc README: https://github.com/opencontainers/runc • OCI runtime-spec: runtime.md: https://github.com/opencontainers/run... • Docker blog: Docker Engine 1.11, built on runC and containerd: https://www.docker.com/blog/docker-en... • Open Container Initiative: overview: https://opencontainers.org/about/over... • Docker docs: docker container stop: https://docs.docker.com/reference/cli... • Docker docs: docker run (--init, --privileged): https://docs.docker.com/reference/cli... • Docker docs: Desktop VMM: https://docs.docker.com/desktop/featu... • Docker docs: Seccomp security profiles: https://docs.docker.com/engine/securi... • Docker docs: Rootless mode: https://docs.docker.com/engine/securi... • gVisor: security model: https://gvisor.dev/docs/architecture_... • Liz Rice: containers-from-scratch: https://github.com/lizrice/containers... • Julia Evans: new zine, How Containers Work: https://jvns.ca/blog/2020/04/27/new-z... Logos belong to their owners and are shown to identify the companies. #SystemDesign #Docker #DockerExplained #HOWDockerWorks #TechExplained