What is a container? Is it really a “lightweight VM” or is it more like a Linux process? In this talk you'll see exactly what a container is, as Liz builds one from scratch in a few lines of Go code. You'll learn how namespaces, control groups and chroot are used to construct containers, and how they are isolated from each other and from the host machine they run on.

1. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved.
@LizRice | @AquaSecTeam
Containers from scratch
Liz Rice
Aqua Security

2. 2@lizrice
Build my own container in Go
■ Namespaces
■ Chroot
■ Cgroups

3. 3@lizrice
Namespaces
■ What you can see
■ Created with syscalls
○ Unix Timesharing System
○ Process IDs
○ Mounts
○ Network
○ User IDs
○ InterProcess Comms

4. 4@lizrice
Chroot
■ Set root directory to a subdirectory within host’s root
Host sees:
/some/directory/on/host/file1
/some/directory/on/host/dir1/file2
Container with chroot to
/some/directory/on/host sees:
/file1
/dir1/file2

5. 5@lizrice
CGroups
■ What you can use
■ Filesystem interface
○ Memory
○ CPU
○ I/O
○ Process numbers
○ ...

6. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved.
@LizRice | @AquaSecTeam
github.com/lizrice/containers-from-
scratch
@LizRice | @AquaSecTeam