Container internals: namespaces and cgroups

In short: A container is not a mini computer but an ordinary Linux process that is walled off from the rest by namespaces and limited in resources by cgroups.

In more detail: Namespaces give the process its own view of system resources: its own process IDs, network, file system, hostname, users. Cgroups limit CPU, memory and I/O. An overlay file system stacks the image from read-only layers and one writable top layer.

In Depth

• Namespaces: pid, net, mnt, uts, ipc, user, cgroup.
• cgroups: Upper limits, weighting, accounting. If a container exceeds memory the kernel kills it (OOM).
• Image: Layers addressed by hash, shared between containers.
• Isolation: All containers share the kernel. Weaker than a VM; security through capabilities, seccomp, rootless.
• VM vs. container: A VM brings its own operating system, a container only process and libraries.
• Runtimes: runc, containerd, Podman; orchestration with Kubernetes.

See also: System calls and kernel mode, Container security