Containers

In Part 1, you isolated processes with Linux namespaces. In Part 2, you added filesystem isolation with pivot_root and OverlayFS. Now it is time to finish the container runtime. In this final part, you will: Add cgroups to limit memory and CPU Set up virtual ethernet pairs for container networking Build a CLI with Cobra Run the final container and compare it with Docker Cgroups: Resource Limits Namespaces control what a process can see. Cgroups control what a process can use. Without cgroups, a container could use all the memory on the host and crash everything. ...

In Part 1, you built a process with isolated namespaces. It has its own hostname, its own process tree, and its own network stack. But it still shares the host’s filesystem. That is dangerous. The containerized process can read /etc/shadow, write to /usr/bin, or delete anything on the host. We need to give the container its own filesystem. In this part, you will: Understand chroot and pivot_root Download and set up a minimal root filesystem Implement pivot_root in Go Add OverlayFS for layered filesystems (just like Docker images) Mount /proc inside the isolated filesystem Preparing a Root Filesystem A container needs a root filesystem — a directory that contains everything a Linux system needs: /bin, /lib, /etc, /proc, and so on. ...

Containers are not virtual machines. They are just Linux processes with extra isolation. In this series, you will build a mini Docker from scratch in Go. No frameworks. No libraries. Just Go and Linux system calls. By the end of this three-part series, you will have a working container runtime that can: Isolate processes with Linux namespaces Create a separate filesystem with OverlayFS Limit resources with cgroups Set up networking with virtual ethernet pairs Run commands through a CLI In this first part, you will learn what containers really are and how to isolate processes using Linux namespaces. ...

You have 10 containers running in production. One crashes at 2 AM. Another gets too much traffic and slows down. A third needs an update, but you cannot take the whole app offline. Who restarts the crashed container? Who routes traffic away from the slow one? Who handles the update without downtime? Kubernetes does all of that. Automatically. This is the first article in the Kubernetes section of our Docker & Kubernetes Tutorial series. If you are new to containers, start with Docker Tutorial #1: What is Docker? first. ...

Docker is the most popular containerization tool in the world. According to the 2025 Stack Overflow Developer Survey, Docker is one of the most widely used tools among professional developers, with usage continuing to grow year-over-year. But what is Docker? And how is it different from a virtual machine? In this tutorial, you will learn what Docker is, how containers work, and why developers use Docker for everything from local development to production deployments. ...

You write an app. It works on your computer. You send it to a friend. It does not work on their computer. They have a different operating system, a different version of Python, or missing libraries. This is the classic “it works on my machine” problem. Docker solves it. What Is Docker? Docker is a tool that packages your application and everything it needs into a container. A container includes your code, libraries, system tools, and settings. It runs the same way everywhere — on your laptop, your colleague’s laptop, or a server in the cloud. ...