I decided to make my own container runtime for fun, and even though I’m still early on, I’ve learned that Docker is weird. Here’s some weird things I learned about Docker.
Containers aren’t real. Unlike VMs, containers are just processes with special restrictions. Your kernel is still running that process, and you can find it in /proc. There’s no single Linux containers feature — containers are really 5 different Linux kernel features in a trenchcoat. Namespaces hide what host and container can see, cgroups limit resource usage, and networking magic isolates a container’s network.
Images are just folders. Docker puts them somewhere and calls chroot (or pivot_root) to make that folder your container’s new root directory. Go is kind of a terrible language for a container runtime. Docker’s runtime, runc, is written in Go, and Go’s design choices make it less suited. Go’s runtime is natively multi-threaded, but many Linux syscalls need a single-threaded environment, so runc has a C module that runs before Go initializes. Go also doesn’t have fork, so runc execs /proc/self/exe to approximate a fork.
Docker requires root. Many Linux kernel APIs require root, so the Docker daemon usually runs as root. Rootless runtimes may have to reimplement the whole networking stack in userspace. Learning is fun! Writing your own version of a tool you use is a great way to learn about it.
Source: Hacker News · Summarized by HeadlinesBriefing