8 ms·

Building a Linux Container Using Namespaces: Part – 1 (2020)

232 points by Arteiii 2y ago

ofey404 2y ago
Obviously, there is a part 2: https://www.polarsparc.com/xhtml/Containers-2.html https://www.polarsparc.com/xhtml/Containers-2.html
asicsp 2y ago
See also: * The What, Why and How of Containers (https://www.annwan.me/computers/what-why-how-containers/ https://www.annwan.me/computers/what-why-how-containers/) * Containers from Scratch (https://ericchiang.github.io/post/containers-from-scratch/ https://ericchiang.github.io/post/containers-from-scratch/) * Linux Containers From Scratch in C (https://www.lucavall.in/blog/barco-linux-containers-from-scratch-in-c https://www.lucavall.in/blog/barco-linux-containers-from-scr...) * Life of a Container (https://indradhanush.github.io/blog/life-of-a-container/ https://indradhanush.github.io/blog/life-of-a-container/)
- kuizu 2y ago
  Also * 10-part series explaining all relevant Linux container mechanisms ( https://www.schutzwerk.com/blog/linux-container-intro/ https://www.schutzwerk.com/blog/linux-container-intro/ )
- Arteiii 2y ago
  thank you very much was looking for more good resources
- shuss 2y ago
  There's also Gocker: https://github.com/shuveb/containers-the-hard-way https://github.com/shuveb/containers-the-hard-way
mperham 2y ago
Based on Ubuntu 18.04, which is pretty old now. Are there any relevant changes for 22.04 or 24.04 or is this stuff stable now?
- supriyo-biswas 2y ago
  The userspace stuff of the Linux kernel doesn’t change all that much, and iproute2 (the ip command) has been around for a while. The only difference is that it’s a little easier to write Go programs now, and you don’t need to mess around with $GOPATH.
- WhatIsDukkha 2y ago
  Yes this looks like it is using cgroups v1 and v2 does changes things up enough that its not a great guide.
bdd8f1df777b 2y ago
A side note: the page does not declare utf-8 encoding. I have manually change it to resolve some of garbled text.
- deleted 2y ago
  [deleted]
- gtirloni 2y ago
  Out of curiosity, which browser are you using?
  - bdd8f1df777b 2y ago
    Google Chrome Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Annatar 2y ago
[dead]
begueradj 2y ago
This is what I used as a university student. Pretty effective. But I guess the author did not share his opinion about them.
zhengiszen 2y ago
I guess cgroups come as version 2 https://www.redhat.com/en/blog/world-domination-cgroups-rhel-8-welcome-cgroups-v2 https://www.redhat.com/en/blog/world-domination-cgroups-rhel...
benhoff 2y ago
If you were looking to create testing for networking, i.e., simulating network dropouts for a client-server connections, is this something that you can use namespaces for, or would virtual machines be more fit for purpose?
- nyrikki 2y ago
  It may be both. You could possibly just use network namespaces. While I am too familiar with it to suggest effort required, looking at the Openstack project and how they provision tenant networks may help. It is just python with a three tier model with a message bus. But how they interface with libvirt may help if the namespace abstraction support for the 'ip' command is too clunky for you. It doesn't give you independent stacks and openvswitch will let you build almost anything you would need.
  - benhoff 2y ago
    Ok interesting I'll take a look. I was looking at libvirt, specifically how red hat was doing testing for its container ecosystem to see if there wasn't some juice to squeeze out of how they are managing it.
- jakogut 2y ago
  Look up tc, the traffic control utility that interacts with the Kernel's packet scheduler using the netfilter framework.
tyingq 2y ago
You can get a sort of "reader's digest" version of this by having a look at "bocker". It's about 120 lines of bash that implements the important bits of docker using nsenter, btrfs, cgcreate, etc. https://github.com/p8952/bocker/blob/master/bocker https://github.com/p8952/bocker/blob/master/bocker
WhatIsDukkha 2y ago
This looks to be using cgroups v1 and should be updated to v2 as its not directly compatible and would improve things understanding wise.
shivshivshiv 2y ago
What's the difference between chroot and the mount namespace type?
- rkv 2y ago
  There is no way that I can explain better than this: https://lwn.net/Articles/689856/ https://lwn.net/Articles/689856/

232 points by Arteiii 2y ago

Obviously, there is a part 2: https://www.polarsparc.com/xhtml/Containers-2.html https://www.polarsparc.com/xhtml/Containers-2.html

asicsp 2y ago

See also: * The What, Why and How of Containers (https://www.annwan.me/computers/what-why-how-containers/ https://www.annwan.me/computers/what-why-how-containers/) * Containers from Scratch (https://ericchiang.github.io/post/containers-from-scratch/ https://ericchiang.github.io/post/containers-from-scratch/) * Linux Containers From Scratch in C (https://www.lucavall.in/blog/barco-linux-containers-from-scratch-in-c https://www.lucavall.in/blog/barco-linux-containers-from-scr...) * Life of a Container (https://indradhanush.github.io/blog/life-of-a-container/ https://indradhanush.github.io/blog/life-of-a-container/)

kuizu 2y ago
Also * 10-part series explaining all relevant Linux container mechanisms ( https://www.schutzwerk.com/blog/linux-container-intro/ https://www.schutzwerk.com/blog/linux-container-intro/ )
Arteiii 2y ago
thank you very much was looking for more good resources
shuss 2y ago
There's also Gocker: https://github.com/shuveb/containers-the-hard-way https://github.com/shuveb/containers-the-hard-way

mperham 2y ago

Based on Ubuntu 18.04, which is pretty old now. Are there any relevant changes for 22.04 or 24.04 or is this stuff stable now?

supriyo-biswas 2y ago
The userspace stuff of the Linux kernel doesn’t change all that much, and iproute2 (the ip command) has been around for a while. The only difference is that it’s a little easier to write Go programs now, and you don’t need to mess around with $GOPATH.
WhatIsDukkha 2y ago
Yes this looks like it is using cgroups v1 and v2 does changes things up enough that its not a great guide.

bdd8f1df777b 2y ago

A side note: the page does not declare utf-8 encoding. I have manually change it to resolve some of garbled text.

deleted 2y ago
[deleted]
gtirloni 2y ago
Out of curiosity, which browser are you using?
- bdd8f1df777b 2y ago
  Google Chrome Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Annatar 2y ago

[dead]

begueradj 2y ago

This is what I used as a university student. Pretty effective. But I guess the author did not share his opinion about them.

zhengiszen 2y ago

I guess cgroups come as version 2 https://www.redhat.com/en/blog/world-domination-cgroups-rhel-8-welcome-cgroups-v2 https://www.redhat.com/en/blog/world-domination-cgroups-rhel...

benhoff 2y ago

If you were looking to create testing for networking, i.e., simulating network dropouts for a client-server connections, is this something that you can use namespaces for, or would virtual machines be more fit for purpose?

nyrikki 2y ago
It may be both. You could possibly just use network namespaces. While I am too familiar with it to suggest effort required, looking at the Openstack project and how they provision tenant networks may help. It is just python with a three tier model with a message bus. But how they interface with libvirt may help if the namespace abstraction support for the 'ip' command is too clunky for you. It doesn't give you independent stacks and openvswitch will let you build almost anything you would need.
- benhoff 2y ago
  Ok interesting I'll take a look. I was looking at libvirt, specifically how red hat was doing testing for its container ecosystem to see if there wasn't some juice to squeeze out of how they are managing it.
jakogut 2y ago
Look up tc, the traffic control utility that interacts with the Kernel's packet scheduler using the netfilter framework.

tyingq 2y ago

You can get a sort of "reader's digest" version of this by having a look at "bocker". It's about 120 lines of bash that implements the important bits of docker using nsenter, btrfs, cgcreate, etc. https://github.com/p8952/bocker/blob/master/bocker https://github.com/p8952/bocker/blob/master/bocker

WhatIsDukkha 2y ago

This looks to be using cgroups v1 and should be updated to v2 as its not directly compatible and would improve things understanding wise.

shivshivshiv 2y ago

What's the difference between chroot and the mount namespace type?

rkv 2y ago
There is no way that I can explain better than this: https://lwn.net/Articles/689856/ https://lwn.net/Articles/689856/