Building blocks for containers
Kernel Namespaces
They allow for isolation (mount points, network interfaces, user identifiers, process identifiers)
Usually they are created using either unshare or clone system calls. The other relevant system call for namespace manipulation is setns, which allows the user to enter a specified namespace.
Control Groups (cgroups)
Cgroups are used to handle resource allocation for containers. This includes system resources like cpu, memory and device access.
Network
We probably want to use a “bridge” network setup
ip addr show
ip route
# run on host and then ping from container, you should see stuff
tcpdump -i gocker0 icmp and icmp[icmptype]=icmp-echo
# to see your tables
iptables -L