Ryan P. Gniadek

Ryan P. Gniadek

Home Projects Experience Contact Me

docker isn't magic: it isn't a virtual machine either

Docker is the most popular engine for running Linux containers which are an increasingly popular way to deploy applications. Many people use containers but fewer people know what a container actually does. I hope you enjoy this short talk I gave to the Linux and Unix Users Group at Virginia Tech where I overview what actually happens when you type docker run.

Click here to watch the talk

A few key points from the talk:

  • Docker is NOT a hypervisor
    • Rather, Docker allows you to isolate a process at multiple levels through namespaces
      • mnt: filesystem
      • pid: process
      • network: isolated network stack
      • user: allows non-root on host to be mapped to root in container
      • uts: dedicated hostname
      • ipc: dedicated memory
  • After cgroups were added to the Linux kernel in 2007, several projects emerged that took advantage of them by creating containerization processes
    • LXC — “Linux Containers”
    • LMCTFY — Google’s internal container stack pre-Docker
    • systemd-nspawn — “chroot on steroids,” packaged with systemd
    • rkt — Dameonless OCI-compliant runtime from CoreOS
  • Docker was originally started to build tooling around Linux Containers that were more developer friendly but before long, dropped LXC to establish the "Open Container Initiative" (OCI)
    • The basic idea is that any OCI-complaint runtime can run any OCI-compliant image, so there is full compatibility
  • In the talk all of the behavior I demo "manually" in bash can be mirrored to a docker command
    • When I used wget to obtain the tarball of my filesystem before the talk that is similar to pulling an image using docker pull
      • Pro tip: look at all local container images with docker image ls
    • When I run my "container" with chroot that is similar to using docker run <image name>
    • When I attach to the already running container using nsenter that is similar to using docker exec

The following sources were extremly helpful in preparing this talk:

← Back to home