The document discusses building containers from scratch using Go, focusing on key components like namespaces, chroot, and cgroups. It explains how namespaces affect visibility and process isolation, and how chroot sets a restricted root directory for processes. Cgroups are introduced as a way to manage system resources such as memory and CPU for containers.

1. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved.
@LizRice | @AquaSecTeam
Containers from scratch
Liz Rice
Aqua Security

2. 2@lizrice
Build my own container in Go
■ Namespaces
■ Chroot
■ Cgroups

3. 3@lizrice
Namespaces
■ What you can see
■ Created with syscalls
○ Unix Timesharing System
○ Process IDs
○ Mounts
○ Network
○ User IDs
○ InterProcess Comms

4. 4@lizrice
Chroot
■ Set root directory to a subdirectory within host’s root
Host sees:
/some/directory/on/host/file1
/some/directory/on/host/dir1/file2
Container with chroot to
/some/directory/on/host sees:
/file1
/dir1/file2

5. 5@lizrice
CGroups
■ What you can use
■ Filesystem interface
○ Memory
○ CPU
○ I/O
○ Process numbers
○ ...

6. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved.
@LizRice | @AquaSecTeam
github.com/lizrice/containers-from-
scratch
@LizRice | @AquaSecTeam