A deep dive into the history of containers as well as an introduction to how they work under the covers. This includes a discussion around Control Groups and Process Namespaces, as well as touching on some underlying syscalls, such as Fork and Clone.
25. Creating a New Process Namespace
●
unshare --fork --net /bin/bash
26. Creating a New Process Namespace
●
$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen
1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group
default qlen 1000
link/ether 02:f4:7c:c4:3b:a3 brd ff:ff:ff:ff:ff:ff
27. Creating a New Process Namespace
●
$ ip link
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN mode DEFAULT group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
●
28. Creating a New Process Namespace
static int child_exec(void *parent_args) {
printf("New Namespace:n");
system("ip link");
return(0);
}
int main(int argc, char **argv) {
printf("Host: n");
system("ip link");
printf("n----nn");
int clone_flags = SIGCHLD | CLONE_NEWNET;
pid_t child_pid = clone(child_exec, child_stack + STACKSIZE, clone_flags, NULL);
waitpid(child_pid, NULL, 0);
exit(EXIT_SUCCESS);
}
29. Creating a New Process Namespace
int clone_flags = SIGCHLD | CLONE_NEWNET;
pid_t child_pid = clone(
child_exec,
child_stack + STACKSIZE,
clone_flags,
NULL
);
30. Creating a New Process Namespace
● clone(2) fork(2)
○ clone(2) fork(2)
○ fork(2) clone(2)
○
○