MY. MINBOX HOW TO
MY. MINBOX DOWNLOAD

I wrote something simple that prints out some environmental information, lists files in its directory, then exits. $ cd $GOPATH/src//jayconrod/miniboxīuild the program that will run in the container.

MY. MINBOX DOWNLOAD

You'll need to have Go installed, and you'll need root access on your system.įirst, download the project.

MY. MINBOX HOW TO

Demoīefore we dive into the code, I'll show how to use this thing. I avoided using C as much as possible though since string manipulation and memory management are an absolute pain. There were a few things that didn't quite work, so I dropped down into C in a couple places. Go provides easy access to system calls via wrappers in /x/sys/unix. I only used a mount namespace processes in this container are not isolated from the network or anything else. All configuration is done on the command line. My goal was to package a statically linked program and some related files in an ext2 disk image, mount that at the file system root inside a mount namespace, then execute the program. In order to understand containers better, I built a tiny, crappy version of Docker.

Docker, at its lowest level, is a layer of packaging and configuration on top of the raw functionality built in the kernel. A container is a collection of programs and resources that run in isolation from the rest of the processes on a system. Namespaces are the foundation of containers. Additional namespaces were added after 2006: there are now namespaces for process IDs, network, interprocess communication, UTS (host and domain name), user IDs, and control groups. Each mount namespace has its own mount table, so processes in different mount namespaces have different views on which filesystems are mounted, and where. Most global system resources were not virtualized before namespaces came along: all processes had the same view of the file system, the network, user IDs, and IPC. Some resources have always been virtualized in Linux: access to memory (virtual memory) and the CPU (preemptive scheduling). I mean virtualization in the computer science sense here: isolating a process's view of the rest of the system from other processes. BackgroundĬontainers in Linux are implemented using namespaces, which are a relatively new virtualization mechanism. I decided to learn more about them by writing my own tiny container implementation. I've played around with Docker, and it basically seems like magic. I've been curious about how Linux containers work for a long time.

My. minbox