I decided to create my own receptacle runtime for fun, and equal although I’m motionless first on, I’ve learned that Docker is weird. Here’s several weird things I learned concerning Docker.
Containers aren’t real
Unlike VMs, containers are fair processes alongside particular restrictions on them. Your kernel is motionless operating that process! And if you cognize anywhere to look, you can equal discover that procedure in /proc.
Containers really aren’t real
There’s not really a linux characteristic that’s fair “containers” either. Instead, containers are really 5 distinct linux kernel features in trenchcoat.
Namespaces conceal what the presenter and receptacle can see, cgroups bounds receptacle asset usage, and there’s a entire bunch of networking magic I don’t comprehend that lets you isolate a container’s network.
Images are fair folders
Images are fair folders that Docker puts location and afterward calls chroot (or pivot_root) to create that directory your receptacle process’s new base directory. So if you run docker run -it --rm ubuntu /bin/bash, Docker is going to:
- Download the ubuntu depiction from Dockerhub.
- Put that depiction somewhere.
- Run /some/weird/docker/path/bin/bash
Go is benevolent of a awful tongue for a receptacle runtime
Docker’s receptacle runtime, runc, is written in Go, and Go has several scheme choices that create it small suited for a receptacle runtime. Go’s runtime is natively multi-threaded. That’s a really chill feature, but it leads to several challenges in runc.
Many of the Linux syscalls a receptacle runtime needs to create have to be done in a single-threaded environment, so runc has a insane C module that runs before Go’s runtime initializes so it can run those syscalls.
Go additionally doesn’t have fork! Fork lone forks the chief thread, so it’s benevolent of a footgun in a runtime akin Go’s. But a receptacle runtime really wants to fork, set up a bunch of restrictions, and afterward exec the procedure you really put in docker run. To get about this, runc execs /proc/self/exe alongside a particular command row arguement that identifies it as a kid procedure to approximate a fork.
Docker requires root!
This is beautiful uncomplicated to young female if you, akin me, run Docker in MacOS. Many of the Linux kernel APIs that receptacle runtimes use require, or at smallest used to, to be run as root, so the Docker daemon normally runs as root. I can lone ideate that receptacle safety is a extremely durable job.
This seems improved these days. The big elimination seems to be networking. If you’re operating a rootless receptacle runtime, it looks akin it has to reimplement the entire networking stack in userspace to really provision you the identical features!
Learning is fun!
I’ve lone fair started my own receptacle runtime, and I already awareness akin I’ve learned so much concerning Docker. Writing your own type of a tool you use is a awesome way to study concerning it!
