Docker Is Weird

What the author learned

The author started writing a simple container runtime for fun. While doing this, they found many strange things about Docker. Containers are not like virtual machines. A container is a normal process on the Linux kernel, but with special limits. The kernel still runs it, so you can see it in the /proc folder.

How containers are built

Containers are not one single Linux feature. They are made from about five Linux kernel features working together. Namespaces hide what a container can see. Cgroups limit how much CPU and memory a container can use. Networking tools isolate the container's network. An image is just a folder. Docker sets this folder as the new root directory for the container's process, using chroot or pivot_root.

Key facts

• Containers are about 5 Linux kernel features combined.
• Running docker run -it --rm ubuntu /bin/bash does three steps: download the ubuntu image, store it in a folder, and run bash inside that folder.
• Docker's runtime, runc, is written in Go.
• runc uses a small C module that runs before Go starts, to make some system calls in a single thread.
• runc runs /proc/self/exe with a special flag to act like a fork, because Go does not have a real fork.

Why it matters

Knowing how Docker works helps developers understand what containers can and cannot do. It also shows why security matters. Docker's daemon has usually run as root, which makes container security a hard job. Rootless modes are improving, but networking is still hard to make work without root.

What to watch

• Whether rootless container runtimes can match Docker's networking features.
• How runc handles Go's threading limits in future versions.
• Whether more people build their own small runtimes to learn how containers work.