Skip to content
Putting It All Together
step 1/5

Reading — step 1 of 5

Read

~1 min readContainer Lifecycle

Putting It All Together

You now have every piece of a container runtime:

LayerLesson
PID namespace1
Mount namespace2
Net namespace3
Memory cgroup4
CPU cgroup5
PID cgroup6
rootfs7
Image layers8
Copy-on-write9
Container lifecycle10
exec & attach11

What we glossed over:

  • OCI spec: the standard container format Docker, Podman, CRI-O all comply with. Defines the runtime interface (config.json + rootfs).
  • runc: the reference implementation of the OCI runtime spec. ~5000 lines of Go.
  • containerd: a higher-level daemon that manages images, networking, and many runtimes. The thing Docker actually talks to.
  • Image registries: how images are stored and shipped (Docker Hub, ECR, GCR). HTTP API + OCI image format.
  • Capabilities: instead of root/non-root, Linux has fine-grained capabilities (CAP_NET_ADMIN, CAP_SYS_PTRACE...). Docker drops most by default.
  • seccomp / AppArmor / SELinux: kernel sandboxing layers ON TOP of containers. Important for security; required by SOC2/PCI.
  • rootless containers: running Docker without root. Uses user namespaces to map container UID 0 to a non-root user on the host. Greatly reduces attack surface.

You now understand what Docker, Podman, runc, containerd, Kubernetes (which uses CRI to talk to a runtime) actually do under the hood. Container "magic" is just clever combinations of namespaces, cgroups, and overlayfs.

Discussion

Ask a question, share an insight, or help someone who’s stuck.

Sign in to post a comment or reply.

Loading…