Videos / DevOps

Episode 6 of 14 · DevOps, end to end

Containers: namespaces, cgroups, and the layered filesystem

Chapters

1. One kernel, or two0:00
2. Same process, two numbers0:16
3. The kernel has no container0:33
4. There is no boot at all0:50
5. The boundary is not the same1:07
6. Three questions, three mechanisms1:24
7. A private copy of one list1:40
8. P i d number one1:57
9. Two containers, one port2:15
10. Slash means somewhere else2:34
11. How you actually make one2:52
12. Root that is not root3:11
13. Seeing is not using3:29
14. A share of time3:47
15. Throttling is a full stop4:02
16. Two memory knobs4:19
17. What the killer does4:36
18. The numbers proc still lies4:53
19. A stack of transparent sheets5:11
20. Layers only ever add5:27
21. Named by its own contents5:44
22. A tag is a pointer6:00
23. The union mount6:17
24. The copy-up cost6:35
25. Docker run is four programs6:52
26. Three specifications7:07
27. A bundle is a directory7:26
28. Runc, then gone7:45
29. Kubernetes never calls docker8:03
30. The bottom is swappable8:22
31. One shared floor8:39
32. Narrowing the syscall surface8:57
33. Root, cut into pieces9:15
34. What people mount in9:34
35. The short boring list9:51
36. What none of it fixes10:09
37. One kernel, three lies10:27

Containers: namespaces, cgroups, and the layered filesystem. A virtual machine boots its own kernel. A container does not. It is one Linux process, running on the host's kernel, that has been lied to about what it can see and how much it can

Mark as watchedSaved in this browser only.