Container Creation

Combining everything: creating a container is essentially:

1. Resolve the image (manifest, layers)
2. Allocate an overlay mount: lowerdir = layers, upperdir = new dir
3. Set up namespaces:
   - PID namespace (CLONE_NEWPID)
   - Mount namespace (CLONE_NEWNS)
   - Network namespace (CLONE_NEWNET)
   - UTS namespace (CLONE_NEWUTS) — for hostname isolation
   - IPC namespace (CLONE_NEWIPC) — for SysV IPC, msg queues
   - User namespace (CLONE_NEWUSER) — for UID mapping (optional)
4. Set up cgroups:
   - Memory, CPU, pids, devices, blkio
5. Setup networking:
   - Create veth pair
   - Move one end into container netns
   - Assign IP from container subnet
   - Add iptables NAT rules
6. pivot_root into the merged overlayfs
7. Execute the entrypoint as PID 1 in the new namespace

The OS provides each piece; Docker is the orchestrator. runc (the actual container runtime under Docker) is ~5000 lines of Go.

Container LIFE STATES:

• Created: bundle is ready, root not yet running
• Running: entrypoint is alive
• Paused: SIGSTOP'd via cgroup freezer
• Stopped: entrypoint exited (zombie unless removed)
• Removed: rootfs and metadata gone

Docker's docker run is create + start. docker exec runs a new process in the same namespaces.

For this lesson: model the state machine.