On what is Docker isolation based?

Docker isolation is based on leveraging Linux kernel features: namespaces and cgroups.

• Namespaces provide resource isolation at the level of resource names. Each container gets its own set of namespaces, allowing it to "see" only its resources and processes. Main namespaces:

  • PID (Process ID): Process list isolation. Inside the container, PID 1 is the init process.
  • NET (Network): Network stack isolation. The container has its own network interface(s), IP address(es), routing table, iptables rules.
  • UTS (Unix Time-sharing System): Hostname and domain name isolation.
  • MNT (Mount): Filesystem isolation. The container has its own root filesystem.
  • USER: User and group ID isolation (UID/GID). Allows root in the container to be a regular user on the host.
  • IPC (Inter-Process Communication): Inter-process communication mechanisms isolation (semaphores, shared memory).

• Cgroups (Control Groups) provide isolation and control over host resources such as CPU, memory, disk I/O, network bandwidth. Using cgroups, resource consumption of containers can be limited, preventing them from affecting each other and the host. For example, a container can be allocated a certain number of CPU cores or maximum RAM.

The combination of namespaces for resource visibility isolation and cgroups for resource consumption control provides a strong yet lightweight process isolation for containers compared to traditional virtual machines.

# Example of using namespaces in Linux
# Running a command in new PID, UTS, MNT, NET namespaces
# unshare --pid --uts --mount --net --fork /bin/bash

# Example of using cgroups to limit process memory
# mkdir /sys/fs/cgroup/memory/my_container
# echo 100M > /sys/fs/cgroup/memory/my_container/memory.limit_in_bytes
# echo $$ > /sys/fs/cgroup/memory/my_container/tasks
# # The process started in the current shell is now limited to 100MB of memory