Isolation in Containers
This is achieved by using namespaces.
Docker makes containers feel like separate machines. But that isn't true.
A container is just another process with a different set of namespaces.
Image Contents
The docker image has its own userspace rootfs filesystem. It has its own /bin, /lib, /usr, and /etc. These are mounted into a new mount namespace.
clone() Method
Like the Linux fork() method, containers use the clone() method to start the process. The Dockerfile's app process starts this way.
This method lets you pick which namespaces the new process needs to be launched with.
When you pass --network=host to the docker command, it just skips creating the network namespace.
kernel dependency
A container has no kernel inside it. It works only on a host whose kernel it was built for.
It has its own rootfs. Still, the host kernel handles all the system calls from the binaries in that rootfs.
Container Creation Process
Container creation process is all about starting the application process with the following points.
- namespaces
- capabilities
- control groups
- seccomp profiles
- AppArmor or SELinux profiles
The runc application uses host namespace to configure all necessary things on the host. After that the runc init process which is running in its own namespace configures itself.
The host runc process is running as root. It can switch the namespaces and configure the container namespace. This is just not implemented as a design choice.
Check mount namespace to understand how the disk is really made visible to the process.