Command Palette

Search for a command to run...

Hectal
Phase 9Advanced10 of 11 in Docker

Container Internals

What a container really is: Linux namespaces, cgroups, the runtime stack (containerd, runc, OCI), overlay filesystems, and rootless containers.

A container isn't a lightweight VM; it's an ordinary Linux process with a restricted view of the system (namespaces), limited resources (cgroups), and a filesystem assembled from image layers (overlayfs). Seeing these pieces directly explains OOM kills, CPU throttling, 'why is PID 1 special', and how Kubernetes actually starts your containers.

0/4 · 0%
4 topics ~28 min 5 code blocks & diagrams
Start with the first topic
1
9.1

Namespaces: Each Container's Private View

Linux namespaces give a process its own view of process IDs, network interfaces, mount points, hostname, IPC, users, and cgroups; a container is a process in a set of new namespaces.

7 min 1 code practice

2
9.2

cgroups: Limits, OOM Kills & Throttling

Control groups limit and account for CPU, memory, I/O, and process counts; container memory limits are enforced by the OOM killer, and CPU limits by throttling.

7 min 1 code practice

3
9.3

The Runtime Stack: Docker, containerd, runc, OCI & CRI

docker run passes through several layers — the Docker daemon, containerd, a shim, and runc — all standardised by OCI specs; Kubernetes talks to containerd directly through the CRI.

7 min 1 diagram 1 code practice

4
9.4

Overlay Filesystems, Copy-on-Write & Rootless Containers

Image layers are stacked read-only directories merged by overlayfs, with a thin writable layer per container; rootless mode and user namespaces run the whole stack without real root.

7 min 1 code practice