What Have Namespaces Done for You Lately?

Liz Rice - Technology Evangelist, Aqua Security
Containers are made with namespacing and cgroups, but what does that really mean? In this talk we'll write a container from scratch in Go, using bare system calls, and explore how the different namespaces affect the container's view of the world and the resources it has access to.

[@xxzzyagf]

This was amazing. Thank you Liz for the presentation and Docker to make it happen. Now I understand all behind the scene details of docker far more better.

[@rewanthtammana]

The hands-on session is super informative. Learned a lot on system internals

[@mickycampbell8565]

Fantastically salient coding demo that drives home some fundamentals of what a container is. Love the fork bomb to prove everything at the end! This was among the 8 best voted at DockerCon17 that I was fortunate enough to see last week in Austin.

[@PrimephotoStudio]

Very helpful, thank you for sharing it with us.

[@anothermaria6981]

Amazing presentation!

[@Ram_Malisetti]

This was an excellent one.. very much useful .. Do we have the equivalent Linux commands to perform the same operations like invoking the system calls in the Linux shell instead from a GO program?
I'm a beginner and trying to understand how to create the containers on my own.
Regards,
Ram

[@triglav2214]

Many syscalls are available via bash but are not really "parameterized". For instance exec 4 > file will call open("file", O_WRONLY|O_CREAT|O_APPEND, 0666) = 3; dup2(3, 4). You don't have to use go, you could use rust or even C.

[@odedpriva]

I believe this is why you want to mount before you chroot: ( taken from here : yarchive.net/comp/linux/pivot_root.html )
'/' is special exactly the same way '.' is: one is shorthand for "current
process' root", and the other is shorthand for "current process' cwd".
So if you mount over '/', it won't actually do what you think it does:
because when you open "/", it will continue to open the _old_ "/". Exactly
the same way that mounting over somebody's cwd won't do what you think it
does - because the root and the cwd have been looked-up earlier and are
cached with the process.
This is why we have "pivot_root()" and "chroot()", which can both be used
to do what you want to do. You mount the new root somewhere else, and then
you chroot (or pivot-root) to it. And THEN you do 'chdir("/")' to move the
cwd into the new root too (and only at that point have you "lost" the old
root - although you can actually get it back if you have some file
descriptor open to it).
Linus