Build Your Own Container Runtime

The nearest board the site has: it follows the command line, what docker run hands to the daemon. This build goes one level underneath it, to the handful of kernel calls the daemon makes on your behalf.

Before you start. This series builds a small copy of the part of Docker that starts a container. A container is a program running with a limited view of the machine: its own file system, its own list of processes, its own network, and a ceiling on the memory it can use. If that word is new, The Shipping Container (Docker) and Running a Container for Real explain it from the Docker side, and Processes, Threads & the Kernel explains the kernel, the part of the operating system that owns the machine and that every program asks for help. If Go is new to you, Enough Go to read these builds is an optional read first. This build makes the kubelet’s job in Kubernetes 06: The Kubelet real: that lesson fakes the step “start the container”, and this one does it.

Code: teaching/code/from-scratch/container/. One Go module called minibox, seven stages, each a program you can run: go run ./01-exec up to go run ./07-everything. Each stage folder holds every file the stage before it needed plus one new file, so the last stage is the whole tool. No Docker, no runc, no library: the build asks the Linux kernel directly through Go’s syscall package.