The document discusses containers and their building blocks. It explains that containers use Linux kernel features like namespaces and control groups to isolate programs and their view of processes, networking, storage and more. This allows multiple containers to safely share the same computer resources while having independent, isolated environments. Key components that enable containers include chroot, union mounts, namespaces, secure computing mode, and control groups.

1. www.zoomint.com
TechTalk: Introduction to
Containers
2019 June 7th | Kernel Team

2. www.zoomint.com
Containers
▪ Linux kernel allows the existence of multiple
isolated user-space instances - containers.
Program running on an ordinary OS can see all
resources (all devices, all files and folders, all
network interfaces) of that computer.
▪ However, programs running inside of a
container can only see the container's contents
and devices assigned to the container.
▪ Containers isolate software from its
surroundings, for example differences between
development and staging environments and
help reduce conflicts between teams running
different software on the same computer.

3. www.zoomint.com
VMs vs Containers

4. www.zoomint.com
Container Building Blocks
▪ Chroot
• 1982 (BSD)
▪ Union Mount
• 1993
▪ Linux Namespaces
• 2002, 2006, 2013
▪ Secure Computing Mode (seccomp)
• 2005
▪ Control Groups (cgroups)
• 2007

5. www.zoomint.com
Chroot
▪ A chroot is an operation that changes
the apparent root directory for the current
running process and its children.
▪ A program that is run in such a modified
environment cannot see and access files
outside the designated directory tree.

6. www.zoomint.com
Union Mount
▪ Union mounting is a way of
combining multiple directories
into one that appears to
contain their combined
contents.
▪ aufs, OverlayFS, Btrfs, ZFS

7. www.zoomint.com
Linux Namespaces
▪ Provide processes with their own
system view of:
▪ Mount (Mount points)
▪ PID (Process IDs )
▪ Network (Network devices,
stacks, ports, etc.)
▪ UTS (Hostname and NIS domain
name )
▪ User (User and group IDs )
▪ IPC (System V IPC, POSIX
message queues)
▪ Cgroup (Cgroup root directory)

8. www.zoomint.com
seccomp
▪ Secure computing mode (seccomp) is a
Linux kernel feature. It can be used to
restrict the actions available within the
container.
▪ SECCOMP_SET_MODE_STRICT: A
process can just read, write and exit,
nothing more!

9. www.zoomint.com
cgroups
▪ Resource Limiting (RAM)
▪ Prioritization (CPU)
▪ Accounting (Measures a
group's resource usage)
▪ Control (Frees and restarts
processes)

10. www.zoomint.com
Thank you for your
attention!

11. www.zoomint.com
Container Image
▪ A container image is a lightweight,
stand-alone, executable package of a
piece of software that includes
everything needed to run it: code,
runtime, system tools, system libraries,
settings.