Containers: Isolating Processes with Linux Namespaces and Control Groups
How can we prevent a container from messing with another process?
All containers run on the same Linux kernel, along with any other application on the operating system. These containers cannot see other processes other and cannot steal resources from them (if we set them up correctly). How does that happen?
The Linux kernel offers two mechanisms that make this possible: Namespaces and Control Groups (cgroups).
Linux comes with many namespace kinds. By default, there is only one namespace for each kind, and all resources belong to those – filesystems, process IDs, user IDs, network interfaces, and others.
We can create additional namespaces to organise these resources so that, when running a process, the process itself has no visibility of anything outside its namespaces.
Here are some of the main kinds:
| Namespace | Isolates |
|---|---|
| Mount | Mount points and filesystem views |
| PID | Process IDs |
| Network | Interfaces, IPs, routes, firewall rules |
| IPC | Inter-process communication |
| UTS | Hostname and NIS domain name |
| User | User and Group ID mapping |
As an example, by assigning two different UTS namespaces to two processes, they see different local hostnames. It appears to them as though they are running on two different machines (as far as hostname goes).
Similarly, if a single Network namespace is shared between two processes, they can communicate with each other. That is how multiple Docker containers running on the same network can interact with each other.
The Linux kernel feature called cgroups is what allows us to specify how much resources a process is allowed to use. We can limit CPU, memory, network bandwidth and so on. This is crucial for preventing one process from consuming all available resources and starving other processes.