Milliseid meetodeid kasutab Docker, et tagada isolatsioon töötavate konteinerite vahel?

Docker provides isolation between containers using several key mechanisms of the Linux operating system:

1. Namespaces — isolate processes, network, filesystem, and other resources. For example:

   • PID namespace — isolates processes so that processes in one container do not see processes in another.
   • Network namespace — separate network interfaces and IP addresses for each container.
   • Mount namespace — isolates the filesystem.

2. Control Groups (cgroups) — limit and control the resource usage (CPU, memory, disk, network) of each container, preventing one container from affecting the performance of others.

3. Union File Systems (OverlayFS, AUFS, etc.) — allow creating isolated filesystems for each container on top of a shared base image.

4. Capabilities and Security Modules (e.g., SELinux, AppArmor) — restrict the rights of processes inside the container to enhance security.

In this way, Docker uses the capabilities of the OS kernel to create lightweight, isolated environments that operate independently of each other.