The document discusses building containers from scratch using Go, focusing on key concepts like namespaces and cgroups. It outlines how namespaces create isolated environments for processes and how cgroups manage resource allocation. The content is linked to additional resources on GitHub for further exploration.

1. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved.
@LizRice | @AquaSecTeam
Containers from scratch
Liz Rice
Aqua Security

2. docker run <image>

3. 3@lizrice
Build my own container in Go
■ Namespaces
■ Chroot
■ Cgroups

4. 4@lizrice
Namespaces
■ What you can see
■ Created with syscalls
○ Unix Timesharing System
○ Process IDs
○ Mounts
○ Network
○ User IDs
○ InterProcess Comms

5. 5@lizrice
CGroups
■ What you can use
■ Filesystem interface
○ Memory
○ CPU
○ I/O
○ Process numbers
○ ...

6. :(){ :|: & };:

7. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved.
@LizRice | @AquaSecTeam
github.com/lizrice/containers-from-scratch
github.com/aquasecurity/microscanner
@LizRice | @AquaSecTeam