Container isolation primitives

[mokuki082]

Document all of the container isolation primitives and investigate the kernel API for each isolation primitive.

[mokuki082]

Current progress update:

Namespaces

UTS

What I've done

• I have created a process in a separate UTS namespace using C

  What I need to do

• A thorough understanding of what the UTS namespace isolates.
• Notes

Network

What I've done

• Understanding of what the NET namespace isolates.
• Created a VPN prototype utilising linux network namespace usingiproute2 package.

  What I need to do

• Research different ways of building connections and creating namespaces via netlink. details are in #1

PID

• Understanding of what the PID namespace isolates
• It is hierarchical
• procfs needs to be mounted for the ps command to work.

IPC

What I know

• The IPC namespace isolate the process id of the current and all forked (chlidren) processes from the parent process.
• To illustrate see the IPC namespace via ps, /proc must be mounted under the namespace.

Mount

What I've done

• Understand the usage of the mount unix command.
• Understand how to mount from C library mount(2)
• Understand different types of mounts, bind mount, slave mount, etc.

User

What I've done

• Knowing that each user/group has a particular range of available space that they can assign to a User namespace.

  What I need to do

• Research, note taking.

Cgroup

What I know

• How memory cgroup is achieved at a lower level
• How cgroups are created and queried.

  What I need to do

• Research all subsystems of cgroup.

[mokuki082]

Closing this because I've already got a pretty good understanding on namespaces, though more would need to be done as I come across more questions. I've created a simple example to illustrate my understanding in linux namespaces and cgroups