Inside Docker: namespaces, cgroups, OCI and runc
You build a container by hand from kernel features without Docker and see what containerd, runc and the OCI specs do at each layer.
Level 501 · 12 lessons · 12 practice labs
Lessons
Kernel building blocks
- Namespaces: unshare and nsenter
- Limiting resources with cgroup v2
- chroot, pivot_root and the root file system
- Capabilities and seccomp inside a container
- Short task: build a container using only kernel tools
Runtime layers
- The dockerd, containerd and shim chain
- Running a container from an OCI bundle with runc
- The OCI image spec: manifest, layers, digests
- Rootless containers and user mapping
- Short task: unpack an image by hand and run it with runc
Wrap-up
- Where container isolation weakens: a defender’s view
- Capstone: write a tiny container runner and compare it with Docker
Practice labs
- Step into a tool-less container’s network: Enter the network namespace of a container with no network tools from the host with nsenter, and report its listening ports and routing table.
- A cgroup limit set by hand: Without Docker, create a cgroup v2 group, set memory and process-count limits, move a process into it and show from the counters that the limits kick in when exceeded.
- The process that slipped into a container’s namespaces: On the lab machine, find the process that doesn’t show in docker top yet shares a container’s namespaces by comparing namespace ids and cgroup records, and explain how it got in.
- A service running on one capability: Run the web service with all capabilities dropped and only the low-port bind capability added, and show the capability list and that the service answers.
- An app that won’t start under a tight profile: Trace which system call the app trips on when it fails with a permission error under a custom seccomp profile, add only that call to the profile and show the app runs.
- Three containers with weak isolation: On your own lab machine, assess how far three containers running with privileged mode, the host PID namespace and a mounted Docker socket can reach the host, and write a hardened run command for each with proof.
- Verify layer digests by hand: Read the manifest and config of an exported image, list the layers in order and show each layer’s sha256 digest matches the manifest.
- A runc bundle that won’t start: Fix the config.json of an OCI bundle with a wrong root filesystem path, terminal setting and user mapping, and run the container with runc.
- Files owned by nobody: Work out from uid_map and the subordinate id ranges why files in a mounted folder show as ‘nobody’ in a rootless container, fix the mapping and show ownership is right inside and outside.
- Enter a small root file system with chroot: Unpack a root file system from an exported image, enter it with chroot and explain with command output why this environment still sees the host’s processes and network.
- Build a container with kernel tools only: Without Docker, use unshare and pivot_root to build an environment with its own PID, mount and hostname namespaces, and show that your shell is process 1 inside and the old root is no longer visible.
- Where does your tiny runner differ from Docker?: Add a memory limit and capability dropping to the given tiny container runner script, run the same image with Docker as well and produce a difference table comparing the namespaces, cgroup values and capabilities of the two environments.
About this course
You build a container by hand from kernel features without Docker and see what containerd, runc and the OCI specs do at each layer.
What you will learn
- Kernel building blocks
- Runtime layers
- Wrap-up
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.