What is the basis of container isolation in Docker?

Container isolation in Docker is based on the following core Linux kernel technologies and mechanisms:

1. Namespaces: Allow isolating visibility and access to system resources. Docker uses several types of Namespaces:

   • PID namespace: Isolates processes, each container sees only its processes (PID 1 inside the container).
   • Net namespace: Isolates the network stack (network interfaces, IP addresses, ports, routing rules).
   • Mnt namespace: Isolates filesystem mount points.
   • UTS namespace: Isolates hostname and domain name.
   • IPC namespace: Isolates inter-process communication (IPC) resources (semaphores, shared memory).
   • User namespace: Isolates user and group IDs.

2. Control Groups (cgroups): Allow limiting and controlling the consumption of system resources (CPU, memory, I/O, network traffic) for groups of processes. Docker uses cgroups for:

   • Limiting CPU count or share of processing time.
   • Limiting available memory.
   • Prioritizing or limiting disk I/O.
   • Limiting network traffic.

3. Union File Systems (UnionFS): Create layers of the filesystem. Docker uses UnionFS such as OverlayFS, AUFS (older), Btrfs. They allow:

   • Creating lightweight layers for Docker images.
   • Efficiently using disk space by sharing base layers.
   • Creating COW (Copy-on-Write) layers when writing changes in the container, without modifying the base image.

4. Seccomp (Secure Computing Mode): Restricts system calls that a process inside the container can perform, thereby reducing the attack surface. Docker uses default seccomp profiles for most containers.

5. AppArmor / SELinux: For additional security and isolation, Mandatory Access Control (MAC) modules like AppArmor or SELinux can be used. They provide more granular control over what processes can do (e.g., access files, network resources). Docker can use AppArmor or SELinux profiles if they are configured on the host system.