Linux containers in 500 lines of code (2016)
A C program demonstrates how to implement a basic Linux container from scratch using kernel namespaces, cgroups, and capabilities for process isolation.
read it The literate C code and detailed breakdown of kernel primitives provide a concrete, educational look at how containers work under the hood.
summary
The article walks through a literate C program that builds a functional Linux container from scratch using low-level kernel primitives. It explains how to combine clone flags for namespaces, mount manipulation via pivot_root, capability drops, and cgroup resource limits to sandbox processes. The author analyzes which permissions are categorically unsafe and discusses the security boundaries of raw containerization. While dated, the codebase serves as an instructive deep dive into Linux kernel isolation features.
key points
- Uses clone() with flags like CLONE_NEWPID, CLONE_NEWNS, and CLONE_NEWNET to isolate process trees, mounts, and network interfaces.
- Drops critical capabilities like CAP_SYS_ADMIN and clears the capability bounding set via prctl to restrict root privileges inside the container.
- Establishes a distinct root filesystem using pivot_root and private bind mounts to isolate file system access.
who should read it
Systems engineers and developers looking to understand the low-level Linux kernel primitives behind containerization.
discussion positive
consensus
Commenters focus on the inadequacy of containers as hard security boundaries, recommending microVMs or user-space kernels like Firecracker and gVisor for untrusted code.
pushback
Minor debate centers on the immense operational complexity of deploying more secure alternatives like Kata Containers versus raw VMs or containers.
> I wanted specifically to find a minimal set of restrictions to run untrusted code.
I don't think we should consider containers to be a security boundary. Even full VMs can be escaped, and have been, many times.
The fact that this is possible in the first place makes me think we need a much better approach.
It reframes the discussion around whether containers should ever be treated as a secure isolation boundary.
Generated by an LLM from the article and thread. Check the sources before relying on it.