Building a Linux Container Using Namespaces: Part – 1 (2020) | Hacker News Reader

Building a Linux Container Using Namespaces: Part – 1 (2020)

polarsparc.com

232 pointsArteiii21 comments

Open articleView on HN

Obviously, there is a part 2:

https://www.polarsparc.com/xhtml/Containers-2.html

See also:

* The What, Why and How of Containers (https://www.annwan.me/computers/what-why-how-containers/)

* Containers from Scratch (https://ericchiang.github.io/post/containers-from-scratch/)

* Linux Containers From Scratch in C (https://www.lucavall.in/blog/barco-linux-containers-from-scr...)

* Life of a Container (https://indradhanush.github.io/blog/life-of-a-container/)

Also

* 10-part series explaining all relevant Linux container mechanisms ( https://www.schutzwerk.com/blog/linux-container-intro/ )

There's also Gocker: https://github.com/shuveb/containers-the-hard-way

thank you very much was looking for more good resources

You can get a sort of "reader's digest" version of this by having a look at "bocker". It's about 120 lines of bash that implements the important bits of docker using nsenter, btrfs, cgcreate, etc.

https://github.com/p8952/bocker/blob/master/bocker

I guess cgroups come as version 2 https://www.redhat.com/en/blog/world-domination-cgroups-rhel...

If you were looking to create testing for networking, i.e., simulating network dropouts for a client-server connections, is this something that you can use namespaces for, or would virtual machines be more fit for purpose?

It may be both.

You could possibly just use network namespaces.

While I am too familiar with it to suggest effort required, looking at the Openstack project and how they provision tenant networks may help.

It is just python with a three tier model with a message bus. But how they interface with libvirt may help if the namespace abstraction support for the 'ip' command is too clunky for you.

It doesn't give you independent stacks and openvswitch will let you build almost anything you would need.

Ok interesting I'll take a look. I was looking at libvirt, specifically how red hat was doing testing for its container ecosystem to see if there wasn't some juice to squeeze out of how they are managing it.

Look up tc, the traffic control utility that interacts with the Kernel's packet scheduler using the netfilter framework.

This looks to be using cgroups v1 and should be updated to v2 as its not directly compatible and would improve things understanding wise.

This is what I used as a university student. Pretty effective. But I guess the author did not share his opinion about them.

What's the difference between chroot and the mount namespace type?

There is no way that I can explain better than this: https://lwn.net/Articles/689856/

Based on Ubuntu 18.04, which is pretty old now. Are there any relevant changes for 22.04 or 24.04 or is this stuff stable now?

The userspace stuff of the Linux kernel doesn’t change all that much, and iproute2 (the ip command) has been around for a while. The only difference is that it’s a little easier to write Go programs now, and you don’t need to mess around with $GOPATH.

Yes this looks like it is using cgroups v1 and v2 does changes things up enough that its not a great guide.

A side note: the page does not declare utf-8 encoding. I have manually change it to resolve some of garbled text.

Out of curiosity, which browser are you using?

Google Chrome

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Reply on news.ycombinator.com