What technologies is Docker containerization based on, including?

Based on the following key technologies:

• Cgroups (Control Groups): Linux kernel mechanism that allows limiting, isolating, and monitoring resource usage (CPU, memory, disk I/O, network I/O) by process groups. It enables Docker to manage resources allocated to each container.
• Namespaces: Another Linux kernel mechanism used for isolating operating system resources. Docker uses the following namespaces:
  • Pid (Process ID): Process isolation, each container has its own independent PID namespace.
  • Net (Networking): Network stack isolation, each container has its own network interfaces, IP addresses, and routes.
  • Mnt (Mount): Mount point isolation, the filesystem inside the container does not see the host filesystem (except explicitly mounted).
  • Uts (Unix Time-sharing System): Hostname and domain name isolation.
  • Ipc (Inter-Process Communication): Inter-process communication isolation.
  • User: User ID isolation (in some configurations).
• Union File Systems (UnionFS): Filesystem that allows overlaying one filesystem over another transparently. Docker uses UnionFS (e.g., OverlayFS, AUFS historically) to create layered images. Each image layer represents a set of changes, and the container is created by combining these layers with an additional writable layer.
• Container Runtime: Component responsible for starting and managing the container's lifecycle. Docker previously used its own runtime (LXC, then docker-containerd). Currently, Docker uses the standardized containerd runtime, compliant with the Open Container Initiative (OCI) specification.

// Example concept of using Cgroups and Namespaces at a low level (conceptual)
package main

import (
	"os"
	"os/exec"
	"syscall"
)

func main() {
	// Create a command to run a new process
	cmd := exec.Command("/bin/sh")

	// Apply new namespaces: PID for process isolation, UTS for hostname
	cmd.SysProcAttr = &syscall.SysProcAttr{
		Cloneflags: syscall.CLONE_NEWPID | syscall.CLONE_NEWUTS,
	}

	// Run the command
	cmd.Stdin = os.Stdin
	cmd.Stdout = os.Stdout
	cmd.Stderr = os.Stderr

	// This code does not include cgroups configuration for resource limiting
	// or union file systems for layered storage, which are key parts of Docker.
	// It is only a demonstration of basic Namespace concepts.

	if err := cmd.Run(); err != nil {
		panic(err)
	}
}