rootfs: Container Filesystem

A Docker image is essentially a tarball: a directory tree containing /bin, /etc, /usr, etc., everything a container needs.

To run an image, Docker:

1. Extracts the image to a directory: /var/lib/docker/overlay2/<id>/diff/
2. Creates a new mount namespace
3. pivot_roots into that directory
4. Executes the image's entrypoint

Inside the container, the rootfs IS the filesystem. There's no /host — the host paths are inaccessible (unless explicitly mounted via -v).

A minimal rootfs needs:

• /bin/sh (or /bin/busybox) — for the entrypoint
• /lib, /lib64 — shared libraries (or use static binaries)
• /dev/null, /dev/zero, /dev/random — bind-mounted by Docker
• /proc, /sys — mounted at runtime (the container's view)
• /tmp — usually a tmpfs

The scratch image is empty — perfect for static binaries (Go, Rust). The whole filesystem is just your one binary; container starts in tens of milliseconds.

For this lesson: model the rootfs as a flat namespace of paths and verify that path resolution stays within the rootfs.