Foundations — Containers — namespaces, cgroups, difference from VMs

4.2.41 · D1 · Coding › Operating Systems › Containers — namespaces, cgroups, difference from VMs

Namespaces, cgroups, ya "container vs VM" samajhne se pehle, tumhe kuch words apne karne padenge jo parent note ne freely use kiye the. Hum har ek ko zero se banate hain: plain meaning → picture → topic ko yeh kyun chahiye, ek aisi order mein jahan har item pehle wale pe lean karta hai.

1. Program, process, aur PID

Picture. Program ko ek recipe card socho, aur process ko ek cook jo abhi use bana raha hai. Do cooks ek hi recipe follow kar sakte hain → do processes, same program, alag PIDs.

Topic ko yeh kyun chahiye. Ek container ek process hai (ya unka ek chhota sa group). Jo kuch bhi parent note kehta hai — "PID 1", "PID ko cgroup.procs mein daalo", "echo $$" — woh sab inhi numbered live cooks ki baat kar raha hai. Agar tum ek process ko ek numbered running cheez ke roop mein nahi dekhte, toh "container ka pehla process PID 1 ban jaata hai" gibberish hai.

Related vault reading: Processes and the clone/fork syscall.

2. Kernel aur uski global tables

Picture. Kernel woh building manager hai jo master ledgers rakhta hai. Normally poori machine ke liye har ledger ki bilkul ek copy hoti hai:

• ek PIDs ki list (har running process),
• ek hostname ("yeh machine kya kehlaati hai"),
• ek mount table (kaun si disks folder tree mein kahan dikhti hain),
• ek network stack (cards, IP addresses, ports).

Topic ko yeh kyun chahiye. Ek namespace define hota hai "inhi global tables mein se kisi ek ki private copy" ke roop mein. "Private copy" tab tak nahi samjhaoge jab tak tum single shared original ko point nahi kar sakte. Aur "one kernel = container, many kernels = VM" tab hi samajh aata hai jab tum kernel ko the manager ke roop mein dekho jo the ledgers rakhta hai.

Related vault reading: Linux Kernel — syscalls.

3. Syscall — program kernel se kaise maangta hai

Picture. Ek locked service window socho. Tumhara program ek request slip ("clone, please, in options ke saath") window ke andar dalta hai; kernel privileged kaam karta hai glass ke peeche aur result wapas deta hai.

Topic ko yeh kyun chahiye. Parent mein teen container-making mechanisms — clone, unshare, setns — sab syscalls hain. "Process ko container banana" ka matlab literally hai "sahi syscalls karo." Syscall word ke bina, woh poora mechanism section floating hai.

4. clone / fork / unshare / setns

Picture. Shared ledgers phir se socho:

• clone(CLONE_NEWPID) = "mujhe ek child banao, aur use ek blank new PID ledger do."
• unshare = "main yahan rahunga, lekin shared ledger se mera page nikaalo aur apna start karunga."
• setns = "mujhe us group ke ledger pe jaane do aur unke saath likhne do." Yahi exactly hai docker exec ek running container mein step karne ka tarika.

Topic ko yeh kyun chahiye. Yahi sirf tarike hain jinse private tables exist mein aati hain. Parent ka claim — "flags ko OR karo aur process kuch bhi shared nahi rakhta → full isolation" — bas itna hai: choose karo kaun se ledgers privatise hote hain, ek flag per ledger.

Related vault reading: Processes and the clone/fork syscall.

5. Flags — ek bit per switch

Picture. Light switches ki ek row socho. Har switch = "ek table ki fresh copy do." NEWPID aur NEWNET flip karo, baaki off rakho → new PID list aur new network stack, lekin host jaisa hi same hostname aur mounts. Parent ka "OR them together" hai: ek hi trip mein kaafi switches press karo.

Topic ko yeh kyun chahiye. Yahi woh knob hai jo containers ko partial hone deta hai — tum network isolate kar sakte ho lekin baaki sab share kar sakte ho. "Ek flag = ek privatised table" samajhna hi kyun namespaces enough hain ki poori derivation hai.

6. Filesystem tree, /, mount, aur chroot

Picture. Ek akela tree / se ugta hai. USB stick ko /media/usb pe mount karna wahan ek naya branch laata hai. Ek mount namespace ek process ko ek poora private tree deta hai, taaki uska / bilkul alag folders ka set ho sakta hai (aise hi container ko apna root filesystem milta hai).

Topic ko yeh kyun chahiye. Parent ek Mount namespace list karta hai ("own root /"). Isko feel karne ke liye, tumhe pehle se / ko ek tree ka trunk dekhna hoga jo per process swap ho sakta hai.

Related vault reading: Filesystems — mount and chroot aur, images kaafi read-only layers ko ek / mein stack karne ke liye, Docker images and layered filesystems (overlayfs).

7. Network words: interface, IP, port, bridge

Picture. Ek network namespace ek process ko yeh sab apna deta hai — apne cards, apne IPs, apna port 80. Do containers dono "port 80 pe listen" kar sakte hain bina clash kiye, kyunki har ek ka private network stack hai.

Topic ko yeh kyun chahiye. Parent table mein Network namespace row exactly inhi charon ko name karti hai. Related vault reading: Networking — virtual interfaces and bridges.

8. UID / GID aur "root"

Picture. Ek user namespace ek translation table banata hai: "andar, tum UID 0 (root) ho; bahar, tum actually UID 100000 (ek nobody) ho." Toh container-root apne parde wale room mein powerful lagta hai lekin real house mein powerless hai.

Topic ko yeh kyun chahiye. Parent ka teesra steel-man ("root inside = root outside") tabhi debunk hota hai jab tum ek UID mapping picture kar sako. UID ke bina "kaun sa numbered user hoon main" ke roop mein, woh fix khaali hai.

9. Resources, quota, aur period (cgroup numbers)

Picture. Ek prepaid meter socho. Har period microseconds mein kernel tumhara quota microseconds of CPU time top up karta hai. Jaldi kharcho → tum frozen ho jab tak agli refill nahi aati.

Topic ko yeh kyun chahiye. Yeh poore parent note mein sirf ek real formula hai. Yeh is pe rakhta hai ki CPU time ek resource hai microseconds mein measure hota hua, period ke hisaab se refill hota hua. Related vault reading: Scheduling — CFS and CPU shares.

10. Virtual machine aur hypervisor (contrast partner)

Picture. Jahan ek container ek parde wala room ek hi ghar mein hai (ek kernel), ek VM ek poora doosra ghar paas mein hai apni apni plumbing ke saath (apna kernel). Bhaari, banane mein slow, lekin divarein real hain.

Topic ko yeh kyun chahiye. Poora "Containers vs VMs" section ek comparison hai — tum kisi aisi cheez se compare nahi kar sakte jo tumhare paas hai hi nahi. Related vault reading: Virtualization and Hypervisors (Type 1 vs Type 2).

Yeh topic ko kaise feed karte hain

Upar se neeche padho: process + kernel tumhe woh cheez dete hain jo isolate ho rahi hai aur woh tables jo isolate ho rahi hain; syscalls + flags woh tools hain jo private copies banate hain; woh copies namespaces hain; ek process pe quota/period cgroups hain; dono ko saath rakho aur tumhare paas ek container hai, jise tum phir VM se compare karte ho.

Equipment checklist

Khud test karo — tum parent note ke liye ready ho jab tum har ek ko zor se bol sako.