4.2.41
Intuition Ek-sentence mein poori pictureEk container basically ek normal Linux process hai jisse jhooth bola gaya hai ki woh kya dekh sakta hai (namespaces ) aur jo kuch woh use kar sakta hai uspe limit lagayi gayi hai (cgroups ). Isme koi doosra kernel nahi hota — VM ke unlike. Isliye container hai "isolation by bookkeeping," na ki "isolation by hardware."
Container ek ya zyada processes ka group hota hai jo host kernel pe run karta hai, aur behave aisa karta hai jaise uska apna machine ho — do kernel features ki wajah se:
namespaces → control karta hai process kya DEKH sakta hai (view ka isolation).cgroups (control groups) → control karta hai process kya USE kar sakta hai (resources pe limits).
Koi guest OS kernel nahi hota . Container host ka kernel share karta hai.
YEH design kyun? Ek full VM poora OS duplicate karta hai sirf ek app ko isolate karne ke liye — RAM, boot time, aur disk mein waste. Zyada tar hume sirf chahiye hota hai ki app sooche woh akela hai. Linux already processes manage karta hai; toh hardware emulate karne ki jagah hum kernel ke global resources ko per process group mein partition kar dete hain .
Intuition Ek namespace ekek kism ke global resource list ki alag copy hai.
Normally kernel ke paas ek global table hoti hai process IDs ki, ek hostname, ek network stack, ek mount table. Ek namespace ek process group ko us table ka apna private version deta hai. Andar ke processes sirf apne namespace ki entries dekhte hain.
Kernel kai namespace types offer karta hai, har ek alag cheez isolate karta hai:
Namespace
Kya isolate karta hai (aap kya DEKHTE hain)
PID process IDs — container ka pehla process PID 1 ban jaata hai
Mount (mnt) filesystem mount table — apna root /
Network (net) interfaces, IPs, ports, routing tables
UTS hostname aur domain name
IPC shared memory / semaphores
User UID/GID mapping — andar root ≠ bahar root
Cgroup cgroup hierarchy chhupa deta hai
Worked example PID namespace aapko "PID 1" bana deta haiunshare --pid --fork --mount-proc bash run karo, phir ps aux. Aap sirf apne processes dekhte ho; aapka shell PID 1 ho sakta hai. Yeh step kyun? Naya PID namespace numbering 1 se shuru karta hai, toh host ke hundreds of processes invisible hain — woh exist karte hain, lekin aapki table mein nahi.
Intuition Agar namespacesdivaaren hain (tum neighbours nahi dekh sakte), toh cgroups meter hain (tum building ki poori bijli nahi hog kar sakte).
Ek cgroup ek tree ka node hai; usme processes daalo aur controllers attach karo jo CPU, memory, I/O, PIDs cap karte hain.
Definition cgroup (control group)Ek kernel mechanism jo processes ko group karta hai aur controllers ke zariye unka resource usage account + limit karta hai. /sys/fs/cgroup ke neeche ek filesystem ke roop mein expose hota hai (cgroup v2 = unified hierarchy).
Key controllers aur aap unme kya likhte ho:
Controller
Example knob
Matlab
memory
memory.max = 512Mgroup 512 MB se zyada ho toh OOM-kill
cpu
cpu.max = "50000 100000"100 ms window mein 50 ms CPU = ek core ka 50%
pids
pids.max = 100fork-bomb protection
io
io.maxdisk bandwidth throttle karo
Worked example Memory limit karna (cgroup v2)mkdir /sys/fs/cgroup/myapp
echo 268435456 > /sys/fs/cgroup/myapp/memory.max # 256 MiB
echo $$ > /sys/fs/cgroup/myapp/cgroup.procs # add this shell
Yeh step kyun? PID ko cgroup.procs mein likhne se process group mein move hoti hai; us point se kernel uska RSS sum karta hai aur 256 MiB ke baad OOM-kill karta hai. Limit usi kernel se enforce hoti hai jo host use karta hai — koi hypervisor nahi chahiye.
Intuition Ek kernel vs kai kernels.
VM: hypervisor hardware emulate karta hai; har VM apna pura guest kernel + OS boot karta hai. Strong isolation, heavy (GBs, boot hone mein seconds).Container: host kernel share karta hai; isolation namespaces+cgroups se. Light (MBs, start hone mein milliseconds), lekin kernel bug ka blast radius shared hota hai.
Container
Virtual Machine
Kernel
shared host kernel apna guest kernel
Isolation by
namespaces + cgroups (software)
hypervisor + virtual hardware
Boot time
ms
seconds
Size
MBs
GBs
Overhead
near-native
hypervisor tax
Security boundary
weaker (shared kernel)
stronger (hardware-enforced)
Alag OS kernel run kar sakte ho?
❌ (Linux pe sirf Linux)
✅
Worked example Windows kernel Linux container mein kyun nahi chal saktaEk Linux container Linux kernel ke syscalls reuse karta hai. Windows binaries Windows syscalls call karte hain jo Linux kernel implement nahi karta. Yeh kyun matter karta hai: "Docker for Windows Linux containers run karta hai" sirf isliye kyunki woh secretly ek lightweight VM spin up karta hai jiske andar ek Linux kernel hota hai.
Common mistake Steel-man: "Container ek tiny VM hai."Kyun sahi lagta hai: dono tumhe ek isolated box dete hain apne /, hostname, processes, aur IP ke saath — andar se bilkul ek jaisa lagta hai. Crack yeh hai: container ke andar aur host pe uname -r run karo — same kernel version , kyunki sirf ek hi kernel hai. VM apna alag dikhata. Fix: rule yaad rakho ek kernel = container, kai kernels = VM .
Common mistake Steel-man: "cgroups isolation / security dete hain."Kyun sahi lagta hai: cgroups ek container ko saari RAM khaane se rokta hai, jo protective lagta hai. Crack yeh hai: cgroups quantity limit karte hain, visibility nahi — ek process jiske paas koi namespace nahi lekin cgroup hai woh phir bhi host processes dekh aur kill kar sakti hai. Fix: cgroups = resource limits, namespaces = isolation. Aapko dono chahiye .
Common mistake Steel-man: "Container ke andar root = host pe root."Kyun sahi lagta hai: prompt # dikhata hai aur whoami root bolta hai. Crack yeh hai: user namespace ke saath, container-root (UID 0) ek unprivileged host UID jaise 100000 se map hota hai. Fix: UIDs map karo (rootless containers) taaki container-root woh host files touch na kar sake jo use nahi karni chahiye.
Recall Feynman: ek 12-saal ke bache ko explain karoSocho ek bada ghar hai (computer). Ek VM aise hai jaise paas mein ek bilkul alag ghar banana apni plumbing aur electricity ke saath — strong walls, lekin expensive aur build hone mein slow. Ek container aise hai jaise existing ghar ke ek room ko private bedroom bana do: tum parde lagao taaki bacha baaki ghar na dekh sake (namespaces = parde), aur tumne use ek chore-chart do jo kahe "tum sirf itna snacks aur TV time use kar sakte ho" (cgroups = limits). Yeh wahi ghar, wahi kitchen hai (ek kernel) — kaafi sasta, lekin walls sirf parde hain, toh thodi kam privacy hai.
"See vs Use, Curtains vs Chores."
N amespaces = N ote karo kya See kar sakte ho (parde). C groups = C ap karo kya Use kar sakte ho (chores). VM = poora naya ghar; container = ek parde wala room.
Container banane wale do kernel features kya hain? namespaces (aap kya SEE kar sakte ho usse isolate karte hain) + cgroups (aap kya USE kar sakte ho usse limit karte hain)
Namespace ___ isolate karta hai jabki cgroup ___ limit karta hai namespace → ek global resource ka visibility/view; cgroup → resource consumption
4 namespace types batao. PID, Mount, Network, UTS, IPC, User, Cgroup (koi bhi 4)
Child process ke liye nayi namespaces kaun sa syscall banata hai? clone() with CLONE_NEW* flags (current ke liye unshare bhi, join karne ke liye setns)
docker exec running container mein kaise enter karta hai?setns(fd, type) — existing container ke namespaces mein join karta hai
cpu.max = "50000 100000" ka matlab kya hai?quota/period = 50000/100000 = 0.5 → ek CPU core ka 50%
cgroup v2 cpu.max se CPU share ka formula? CPU share = quota / period (cores mein)
Container aur VM ke beech sabse bada ek difference? Container host kernel share karta hai; VM apna guest kernel hypervisor ke zariye run karta hai
Linux container Windows app natively kyun nahi run kar sakta? Container host Linux kernel ke syscalls reuse karta hai; Windows binaries ko Windows syscalls chahiye jo Linux kernel provide nahi karta
Containers VMs se faster start kyun hote hain? Koi guest OS/kernel boot nahi karna — container bas ek process hai; sirf namespaces+cgroups set up hote hain (ms vs seconds)
Security boundary container hai ya VM, aur kyun? VM (stronger) — hypervisor ke zariye hardware-enforced; container ek kernel share karta hai toh kernel bug sab ko affect karta hai
Container-root host-root ke barabar nahi kyun ho sakta? User namespace — UID 0 andar ko ek unprivileged host UID se map karta hai (rootless containers)
Kya cgroups isolation dete hain? Nahi — woh resource quantity limit karte hain; isolation (visibility) namespaces se aati hai
Processes and the clone/fork syscall Linux Kernel — syscalls Virtualization and Hypervisors (Type 1 vs Type 2) Filesystems — mount and chroot Networking — virtual interfaces and bridges Docker images and layered filesystems (overlayfs) Scheduling — CFS and CPU shares
Container = normal process
PID, mnt, net, UTS, IPC, User
