Overview

A summary of container technology. Experimenting with creating and interacting with containers without using Docker.

What is a Container

A set of processes that are isolated from the host OS, bundling applications and runtime together.

1979: chroot introduced in UNIX OS.

2000: FreeBSD jails appeared in FreeBSD 4.0, an evolution of chroot.

2001: Technology forming the basis of Linux containers appeared in Linux through the VServer Project.

2004: LXC 1.0 released. Linux Containers

2008: Docker emerged.

Besides the above, container technologies like Virtuozzo, OpenVZ, HP-UX Container, and Solaris Container also exist.

Containers
- A set of processes isolated from the host OS, bundling applications and runtime together.
- Shares the kernel part of the host OS
  - The OS library part can be chosen by the container
Virtualization
- Configuration differs between host-based and hypervisor-based, but virtualization allows multiple OS setups, running applications on guest OS.

A rough summary is also available at bmf-tech - What is Docker.

A feature that separates processes into six types of resources (ipc, uts, mount, pid, network, user)
A mechanism that makes it appear as if users have their own isolated resources.
Isolated resources cannot interfere with each other.

Apparmor
- A type of Linux Security Modules (a framework for security in the Linux kernel).
- Securely manages application access permissions (mandatory access control)
SELinux (Security Enhanced Linux)
- A module that adds mandatory access control features to the Linux kernel

An operation that changes the root directory for the current process and its child processes
Processes with changed roots cannot access files outside the range => Realization of process isolation

The Open Container Initiative is an organization aimed at creating industry standards for containers and runtimes.

It defines the following specifications:

OCI is involved in the specifications of low-level runtimes. Examples: runC, gVisor, Kata Containers, Nabla Containers, etc.

CRI defines the interface for communication between kubelet and container runtime.

CRI is involved in the specifications of high-level runtimes. Examples: docker, containerd, cri-o

Containers are processes with isolated resources
Containers share the kernel part of the host OS, and the library part can be freely chosen
Related specifications for containers include OCI and CRI