🚀 I'm Building My Own Container Runtime!
This is part of a complete series where I'm building Conti - a container runtime from scratch. Check it out on GitHub!
About This Series:
- I'm sharing everything I learn while building my own container runtime
- Most concepts come from videos, documentation, and LLM-assisted learning (for educational purposes)
- Focus: Understanding through practice - raw Linux commands and practical implementation
- Important: When building your own container, DON'T copy code from sources - it kills the fun! Write it yourself, break things, debug, and learn.
Why Build Your Own?
- Deep understanding of how containers really work
- Master low-level Linux concepts
- Learn by doing, not just reading
- It's incredibly fun when things finally click!
Network Namespaces
What are Network Namespaces?
Network namespaces provide isolation of network resources, giving each application its own networking stack.
Three Key Network Resources
1. Network Devices
- Ethernet interfaces (eth0, eth1)
- Loopback device (lo)
- Virtual interfaces
2. IP Tables (Firewall Rules)
- Packet filtering rules
- NAT rules
- Security policies
3. Routing Tables
- Route decisions
- Gateway configurations
- Network paths
Visual Architecture
┌──────────────────────────────────────────────────┐
│ Host System │
├──────────────────────────────────────────────────┤
│ │
│ ┌─────────────────────┐ ┌─────────────────────┐ │
│ │ Default Namespace │ │ App Namespace │ │
│ ├─────────────────────┤ ├─────────────────────┤ │
│ │ Devices: │ │ Devices: │ │
│ │ • lo (127.0.0.1) │ │ • lo (isolated) │ │
│ │ • eth0 │ │ │ │
│ │ • docker0 │ │ │ │
│ ├─────────────────────┤ ├─────────────────────┤ │
│ │ IPTables: │ │ IPTables: │ │
│ │ • Complex rules │ │ • Default/empty │ │
│ │ • Firewall config │ │ • Customizable │ │
│ ├─────────────────────┤ ├─────────────────────┤ │
│ │ Routing: │ │ Routing: │ │
│ │ • Internet routes │ │ • Empty initially │ │
│ │ • Local routes │ │ • Isolated │ │
│ └─────────────────────┘ └─────────────────────┘ │
│ │
└──────────────────────────────────────────────────┘
Practical Commands
View Network Resources on Host:
# List network devices
ip link list
# View IP tables rules (requires sudo)
sudo iptables --list
# Show routing table
ip route
Create Network Namespace:
# Create isolated namespace with network isolation
sudo unshare --pid --net --fork --mount-proc /bin/bash
# Inside namespace, check resources:
ip link list # Only loopback device
iptables --list # Different rules
ip route # Empty routing table
Use Cases for Network Namespaces
- Security Isolation: Prevent applications from accessing the internet
- Network Testing: Simulate different network conditions
- Container Networking: Foundation for Docker/Kubernetes networking
- Multi-tenancy: Separate network resources for different applications
UTS Namespaces
What are UTS Namespaces?
UTS (UNIX Time-Sharing) namespaces provide isolation of hostname and domain name.
Visual Concept
┌──────────────────────────────────────────────┐
│ Host: "production-server" │
├──────────────────────────────────────────────┤
│ │
│ ┌────────────────┐ ┌────────────────┐ │
│ │ Web App 1 │ │ Web App 2 │ │
│ │ │ │ │ │
│ │ Hostname: │ │ Hostname: │ │
│ │ "webapp-01" │ │ "webapp-02" │ │
│ │ │ │ │ │
│ │ UTS Namespace │ │ UTS Namespace │ │
│ └────────────────┘ └────────────────┘ │
│ │
└──────────────────────────────────────────────┘
Practical Implementation
# Create namespace with UTS isolation
sudo unshare --uts --pid --fork --mount-proc /bin/bash
# Change hostname in namespace
hostname webapp-01
# Reload bash to see change
exec bash
# Verify hostname
hostname
# Output: webapp-01
Benefits of UTS Namespaces
- Application Identity: Each container can have its own hostname
- Configuration Isolation: Applications can use hostname-based configs
- Testing: Simulate different server environments
IPC Namespaces
What are IPC Namespaces?
IPC (Inter-Process Communication) namespaces provide isolation of:
- System V IPC objects: Message queues, semaphores, shared memory
- POSIX message queues
IPC Resources Isolation
┌───────────────────────────────────────────────┐
│ Host System │
├───────────────────────────────────────────────┤
│ │
│ ┌─────────────────┐ ┌─────────────────┐ │
│ │ Namespace 1 │ │ Namespace 2 │ │
│ ├─────────────────┤ ├─────────────────┤ │
│ │ Message Queue: │ │ Message Queue: │ │
│ │ Key: 0x12345 │ │ Key: 0x67890 │ │
│ │ │ │ │ │
│ │ Processes can │ │ Processes can │ │
│ │ only see their │ │ only see their │ │
│ │ own queue │ │ own queue │ │
│ └─────────────────┘ └─────────────────┘ │
│ ↑ ↑ │
│ └────────┬───────────┘ │
│ Isolated IPC │
└───────────────────────────────────────────────┘
Practical Commands
# Create namespace with IPC isolation
sudo unshare --ipc --pid --fork --mount-proc /bin/bash
# Create a message queue
ipcmk -Q
# View message queues
ipcs -q
# The queue is only visible in this namespace
Commands Reference
Essential Commands Summary
| Command | Purpose | Example |
|---|---|---|
unshare |
Create new namespaces | sudo unshare --net --pid /bin/bash |
ip link |
View network devices | ip link list |
ip route |
View routing table | ip route show |
iptables |
View/modify firewall rules | sudo iptables -L |
hostname |
View/set hostname | hostname NewName |
ipcmk |
Create IPC resources | ipcmk -Q |
ipcs |
View IPC resources | ipcs -q |
Common Namespace Creation Patterns
# Complete isolation (all namespaces)
sudo unshare --uts --ipc --pid --net --fork --mount-proc /bin/bash
# Network testing environment
sudo unshare --net --fork /bin/bash
# Application container simulation
sudo unshare --pid --net --uts --ipc --fork --mount-proc /bin/bash
Summary
Key Takeaways
1. Network Namespaces provide:
- Isolated network devices
- Separate IP tables (firewall rules)
- Independent routing tables
- Foundation for container networking
2. UTS Namespaces enable:
- Hostname isolation
- Domain name isolation
- Per-container identity
3. IPC Namespaces offer:
- Message queue isolation
- Semaphore isolation
- Shared memory isolation
- Secure inter-process communication
Namespace Interaction Diagram
┌─────────────────────────────────────────────────┐
│ Linux Kernel │
├─────────────────────────────────────────────────┤
│ │
│ ┌───────────────────────────────────────────┐ │
│ │ Containerized Application │ │
│ ├───────────────────────────────────────────┤ │
│ │ │ │
│ │ ┌─────────┐ ┌─────────┐ ┌─────────┐ │ │
│ │ │ PID │ │ NET │ │ UTS │ │ │
│ │ │Namespace│ │Namespace│ │Namespace│ │ │
│ │ └─────────┘ └─────────┘ └─────────┘ │ │
│ │ │ │
│ │ ┌─────────┐ ┌─────────┐ ┌─────────┐ │ │
│ │ │ IPC │ │ Mount │ │ User │ │ │
│ │ │Namespace│ │Namespace│ │Namespace│ │ │
│ │ └─────────┘ └─────────┘ └─────────┘ │ │
│ │ │ │
│ │ Complete Resource Isolation │ │
│ └───────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────┘
Real-World Applications
- Docker: Uses all namespace types for container isolation
- Kubernetes: Builds on namespaces for pod isolation
- systemd: Uses namespaces for service isolation
Top comments (2)
What is the difference between namespaces and linux screens ?
Namespaces create isolated mini-systems; Screen just keeps your terminal programs running even if you disconnect.