Containers — namespaces, cgroups, difference from VMs

WHAT is a container, really?

WHY this design? A full VM duplicates an entire OS just to isolate an app — wasteful in RAM, boot time, and disk. Most of the time we only need an app to think it's alone. Linux already manages processes; so instead of emulating hardware, we just partition the kernel's global resources per process group.

namespaces — "what can I SEE?"

The kernel offers several namespace types, each isolating one thing:

Namespace	Isolates (what you SEE)
PID	process IDs — container's first process becomes PID 1
Mount (mnt)	the filesystem mount table — own root `/`
Network (net)	interfaces, IPs, ports, routing tables
UTS	hostname & domain name
IPC	shared memory / semaphores
User	UID/GID mapping — root inside ≠ root outside
Cgroup	hides the cgroup hierarchy

cgroups — "how much can I USE?"

Key controllers and what you write into them:

Controller	Example knob	Meaning
memory	`memory.max = 512M`	OOM-kill if group exceeds 512 MB
cpu	`cpu.max = "50000 100000"`	50 ms CPU per 100 ms window = 50% of one core
pids	`pids.max = 100`	fork-bomb protection
io	`io.max`	throttle disk bandwidth

Worked example Limiting memory (cgroup v2)

mkdir /sys/fs/cgroup/myapp
echo 268435456 > /sys/fs/cgroup/myapp/memory.max   # 256 MiB
echo $$ > /sys/fs/cgroup/myapp/cgroup.procs         # add this shell

Why this step? Writing the PID into cgroup.procs moves the process into the group; from then on the kernel sums its RSS and OOM-kills it past 256 MiB. The limit is enforced by the same kernel the host uses — no hypervisor needed.

Containers vs Virtual Machines

Figure — Containers — namespaces, cgroups, difference from VMs

	Container	Virtual Machine
Kernel	shared host kernel	own guest kernel
Isolation by	namespaces + cgroups (software)	hypervisor + virtual hardware
Boot time	ms	seconds
Size	MBs	GBs
Overhead	near-native	hypervisor tax
Security boundary	weaker (shared kernel)	stronger (hardware-enforced)
Run a different OS kernel?	❌ (Linux only on Linux)	✅

Recall Feynman: explain to a 12-year-old

Imagine a big house (the computer). A VM is like building a whole separate house next door with its own plumbing and electricity — strong walls, but expensive and slow to build. A container is like turning one room in the existing house into a private bedroom: you put up curtains so the kid can't see the rest of the house (namespaces = curtains), and you give them a chore-chart that says "you may only use this much snacks and TV time" (cgroups = limits). It's the same house, same kitchen (one kernel) — much cheaper, but the walls are just curtains, so it's a bit less private.

Flashcards

What two kernel features make a container?

namespaces (isolate what you can SEE) + cgroups (limit what you can USE)

A namespace isolates ___ while a cgroup limits ___

namespace → visibility/view of a global resource; cgroup → resource consumption

Name 4 namespace types.

PID, Mount, Network, UTS, IPC, User, Cgroup (any 4)

Which syscall creates new namespaces for a child process?

clone() with CLONE_NEW* flags (also unshare to move current, setns to join)

How does docker exec enter a running container?

setns(fd, type) — joins the existing container's namespaces

What does cpu.max = "50000 100000" mean?

quota/period = 50000/100000 = 0.5 → 50% of one CPU core

Formula for CPU share from cgroup v2 cpu.max?

CPU share = quota / period (in cores)

Single biggest difference between a container and a VM?

Container shares the host kernel; a VM runs its own guest kernel via a hypervisor

Why can't a Linux container run a Windows app natively?

Container reuses the host Linux kernel's syscalls; Windows binaries need Windows syscalls the Linux kernel doesn't provide

Why are containers faster to start than VMs?

No guest OS/kernel to boot — a container is just a process; only namespaces+cgroups are set up (ms vs seconds)

Which is the security boundary, container or VM, and why?

VM (stronger) — hardware-enforced via hypervisor; container shares one kernel so a kernel bug affects all

What lets container-root not equal host-root?

User namespace — maps UID 0 inside to an unprivileged host UID (rootless containers)

Do cgroups provide isolation?

No — they limit resource quantity; isolation (visibility) comes from namespaces

Connections

Processes and the clone/fork syscall
Linux Kernel — syscalls
Virtualization and Hypervisors (Type 1 vs Type 2)
Filesystems — mount and chroot
Networking — virtual interfaces and bridges
Docker images and layered filesystems (overlayfs)
Scheduling — CFS and CPU shares

Concept Map

Hinglish (regional understanding)

Intuition Hinglish mein samjho

Dekho, container ko samajhne ka sabse easy tareeka yeh hai: container koi mini-computer nahi hai, woh bas ek normal Linux process hai jisko do tarah se control kiya gaya hai. Pehla — namespaces, jo decide karte hain ki process kya dekh sakta hai. Jaise PID namespace ki wajah se container ko sirf apne hi processes dikhte hain, host ke hundreds processes invisible ho jaate hain. Network namespace se uska apna IP, apne ports. Yeh "pardey" (curtains) jaisa hai.

Dusra — cgroups (control groups), jo decide karte hain ki process kitna use kar sakta hai. CPU kitna, RAM kitni, kitne processes fork kar sakta hai. Jaise memory.max = 256M likh do to us group ne 256 MB se zyada liya to kernel use OOM-kill kar dega. CPU ka formula simple hai: quota/period = kitne cores milenge. Yaad rakho — namespaces = isolation (dekhna), cgroups = limits (use karna). Dono chahiye, sirf ek se kaam nahi chalega.

Ab VM se difference — yeh sabse important point hai. VM mein har machine apna poora alag kernel + OS boot karti hai, hypervisor hardware ko emulate karta hai. Isliye VM bhaari hota hai (GBs, seconds mein start). Container mein ek hi kernel sabke beech share hota hai — isliye fast aur light (MBs, milliseconds). Confirm karna ho to container ke andar aur host pe uname -r chala ke dekho — same kernel version aayega, kyunki kernel ek hi hai!

Yeh matter isliye karta hai kyunki containers ne deployment ko revolutionize kiya — same app har jagah same chalta hai, fast scaling hota hai, resources waste nahi hote. Par ek catch: shared kernel matlab security boundary thodi weak hai. High-security ke liye log "container inside a lightweight VM" use karte hain. Bas ek line yaad rakho: ek kernel = container, kai kernel = VM.