Docker Is Weird
An exploration of the technical complexities and 'weird' design choices behind Docker's container runtime. The author explains how Docker leverages Linux kernel features like namespaces and cgroups to manage processes.
Why it matters
Understanding the underlying mechanics of containerization is essential for developers working with modern cloud-native infrastructure.
I decided to make my own container runtime for fun, and even though I’m still early on, I’ve learned that Docker is weird . Here’s some weird things I learned about Docker.
Unlike VMs, containers are just processes with special restrictions on them. Your kernel is still running that process! And if you know where to look, you can even find that process in /proc.
There’s not really a linux feature that’s just “containers” either. Instead, containers are really 5 different linux kernel features in trenchcoat.
Namespaces hide what the host and container can see, cgroups limit container resource usage, and there’s a whole bunch of networking magic I don’t understand that lets you isolate a container’s network.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in