What is used inside a Docker container?

A Docker container uses a range of technologies for process and resource isolation:

• Linux Kernel Namespaces: Provide isolation for various system resources, such as:

  • PID (Process ID): Isolates processes.
  • Net (Network): Isolates the network stack.
  • Mount (mnt): Isolates filesystem mount points.
  • UTS (Unix Timesharing System): Isolates hostname and domain name.
  • IPC (Interprocess Communication): Isolates interprocess communication mechanisms.
  • User (User & Group ID): Isolates user and group identifiers.

• Control Groups (cgroups): Manage and limit hardware resource usage for processes inside the container, including:

  • CPU: Limits CPU time usage.
  • Memory: Limits RAM usage.
  • Block I/O: Limits disk I/O bandwidth.
  • Net I/O: Limits network I/O bandwidth.

• Union File Systems: Provide a combined filesystem consisting of multiple layers. Docker uses filesystems like OverlayFS, AUFS, Btrfs, ZFS. This allows efficient management of image storage and creating layers only for changes.

• Docker Daemon Process: Manages the lifecycle of containers (creation, start, stop, delete).

• Container Runtime: Low-level container execution. Docker has used and supports various runtimes such as runc (OCI specification), containerd.

• Container Image: A set of filesystem layers and metadata necessary to run an application.

• Application: Executable code, libraries, dependencies, and configuration files that make up the program running inside the container.

Essentially, a container is an isolated process (or set of processes) running in a restricted environment provided by the Linux kernel and managed by Docker.