How Docker Works - Intro to Namespaces

[@PwnFunction]

Internals always fascinates me.

[@carlosgarcialalicata]

you should make a playlist of cool internals, and share it with me :)

[@harelr5041]

Jack the ripper was fascinated as well.

[@aspirohk3558]

I swear

[@aspirohk3558]

@@harelr5041 where is that? I soooooo have to watch that

[@puneetkumarsingh1484]

So many videos on internet but this will have a special place amongst all of them since none of them deep dive with such clarity. I finally understand the magic behind docker and more confident in using it. Thank you very much!

[@magicandmagik]

"docker is just a fancy interface around this unshare (system call) namespace feature (of the linux kernel)." This video is amazing, thanks

[@dariofairhall2695]

Nice one

[@nerdy_cat]

This is what I want to see when I search for something. I wish more people would dive deep into things like you do in this video.

[@mechwarrior83]

wow dude your 10 minute video taught me more about container internal workings than 5 years of working with them did! I will be watching this again and again.

[@ivanocj]

One of your best videos ever, congrats! Sweet spot when explaining Docker internals. I just shared with my coworkers. Thanks.

[@khaledismaeel9710]

Really liked how you demonstrated your search inside the docs; it really demystifies the process for novice programmers.

[@PrashantSharma-ql4yb]

This is what I call a high quality content. Very valuable. Thanks for putting in so much effort to create this.

[@Bill-yd3jg]

I always thought Docker was magic, thx so much for the video! (also can we just take a moment for the cute as heck hand-drawn Docker logo?)

[@jousboxx9532]

Great video! The effort put into nifty graphics, scripting, editing and overall quality is *IMMENSELY* appreciated. Most videos on topics like this are just one take (with a bad microphone to boot). Videos like this make containers more accessible and understandable, especially for inexperienced users. You got yourself a new sub!

[@patrickstival6179]

I usually don't understand much of what you say in your videos, but I think in this one stuff are clearer.

[@biyancuh]

Just wanna say absolutely love the big red arrow which forces me to read along with you and not ahead or before like one would with subtitles!

[@love-hammer]

I spent hours researching this specific thing the other day, mostly comparing "containers" to FreeBSD Jails. It's so hard to find useful information wading through all the devops marketing nonsense. Thank you for taking an interest in this topic and sharing your research process.

[@liukang85]

dat zoom at 1:32 🤣 3:48 🤣🤣 exactly how I feel about those kinds of descriptions

[@kaprikornz]

Excellent video! there are a lot of videos on docker out there but none come close to explaining the internals like you do! Thank you so much!

[@nickschmitt8594]

One of the best explanation videos I've ever seen on any topic.

[@jludian]

Had to learn these things the hard way while doing some container escape CTF, this video would have been a very solid starting point. Thank you so much for the effort you put on this, I know the lots of docs you had to review to explain this way.

[@RohanKumar-wf9sc]

Really one of your best videos on how internals work. These things always fascinates me.

[@redouanekachach1053]

Congrats Sr. for this wonderful video explaining the underlying "magic" of the containers which definitely helps to understand better the differences between VM and containers and what does it mean in terms of performance etc. Just for curiosity I checked the wikipedia and the "namespaces" feature was introduced in 2002 in the Linux kernel (inspired by a wider namespaces feature from Bell-Labs's Plan9 OS). It's amazing to see how could a "good feature " can create so much around after almost 20 years :D

[@featherance]

Digging into internals is always an interesting to me, but quite time consuming and easy getting frustrated though. (smile with sweat). Great video :)

[@xarmison]

Wonderful!!!! Please consider doing a series like this one for the kernel modules book.

[@manuelberrueta]

Great job on going into the lower level stuff behind the containers. You truly have a gift!

[@abhinavjain9264]

The BEST video I have ever seen on Docker.

[@BlackHermit]

Great stuff, namespaces are a really cool feature and it's worth an awesome explanation by one of today's greatest processes.

[@jigerjain]

Incredible! You really have a great skill to make these things seem so simple to understand. Hats off and thanks a ton ;)

[@abhijeetpate1194]

bhai bhai

[@lxk3il]

Great video! I am currently also working with docker and in the beginning had the same problem that I lost overview. Your video shows in a very good way what an important role the namespaces play in this process! Thanks a lot for that!

[@WolfrostWasTaken]

Finally! A tutorial about Docker!!! We always use Docker at work to manage our apps in production, so this will be surely interesting

[@oliverlauche5555]

What a great video - I am not the most advanced linux user but this makes perfect sense to me now

[@BobiswHack]

Perfect timing! A few hours ago I was thinking of finding some resources to learn Docker xD Right on time!

[@tymekl1509]

lul

[@PietSahadd]

Hehe, i started fiddling with docker too a few days ago ^^ nice video lifeoverflow 👍

[@User-md3ul]

well you don't learn docker in that sense, you learn on what docker is based (and why there are many alternatives, doing basically the same)

[@JacobP81]

This really clears it up for me. I just started looking into what a docer is and how it differs from a VM and I started reading about namespaces and I was like "What!??"

[@MeanTheBean]

this must be the most information i got about the difference between Docker and VMs! many thanks!

[@vilks_jan]

Great video! Worked a lot with docker lately, yet I haven't really done some digging into how it works. I like your thought process and your problem solving abilities. Thank you for yet another amazing video!

[@uberwebd9824]

please please please make more videos like this. This is invaluable information.

[@TI_Ted]

perfect pacing, a real pleasure to learn from this

[@yezarniko9621]

the best docker explanation.

[@uberwebd9824]

I immediately subscribed to your channel as soon as I saw this video. ty for content like this.

[@everdrone97]

Mind blowing! I love digging into internals and this video is so well done

[@pradeepparsam6471]

Woow!! What an explanation, Thanks for expalining this in a fascinating way, and whoever dislikes this video, shame on you.

[@crackerahul]

Best and detailed explanation. Thankyou for making this.

[@viraatchandra8498]

mah lawd this is comprehensive.... best docker internals overview!

[@AnantaAkash.Podder]

Thank you very much.... Your explanations are just the BEST❤️❤️

[@RegularEverydayNormalGuy]

Thank you for this amazing video, it was great to solidify what I am studying!

[@AshtonSnapp]

A container/namespace is essentially a pocket dimension. You have the main universe or dimension (your computer), but then you can create a dimension within it that can be seen from the main one, but not vice versa.

[@mchammer5026]

Congrats on repeating what he said in the video

[@vijayshreenivos9417]

Awesome intro to namespaces with containerd and runc calls. Could we have a video on cgroups and seccomp as well to cover the security aspects od Docker containers

[@certified-forklifter]

thats literally what i wanted to learn a few days ago! thanks =D

[@shashanksharma21]

Wow this is illuminating! Thank you for making this !

[@mkl.5770]

Thank you so much!! Your tips to analyse what's going on inside are priceless.

[@mimizdani8194]

. Ich müsste mit Docker während ein Projekt im Master arbeiten, bisher könnte ich das Untershied zwischen Docker und VMs nicht verstehen. jetzt es ist Klar für mich, Vielen Dank für die einfachee Erklärung :D schönen Tag noch!

[@sergey1242]

This is the best explanation what is the difference between Vm and container. Thanks a lot

[@zenobikraweznick]

Awesome ! Love that arrows 👍

[@chillyvanilly6352]

This video was MAGNIFICENT!! Thank you a lot!

[@JetJockey87]

Amazing explanation of a ridiculously complex system

[@IDCMI]

VIM has pretty good strace highlighting :) Great videos as always.

[@nowherelefttojump]

absolutely love this explanation!!

[@RandomNullpointer]

Love your videos and their style. Thanks!

[@pictureus]

This video was awesome. Thank you for teaching this in such a clear way.

[@sebastianalexandersson3191]

Amazing video. Super informative and easy to understand. Thanks!

[@mockingbird3809]

I love this video. Really appreciate the efforts you put in to making these amazing quality videos ♥️

[@zyishai]

Thank you for the clear and deep explanation!

[@anatolystrashkevich7621]

thank you very much this is incredibly informative and answered all my questions, thank you again!

[@cmatthew91]

I've been using containers daliy for years at my work, still this was really cool, and informative even for me, thanks

[@0xf172]

Brother , you know if you explain all the documentation existed like this , every damn dev will watch all the videos 😅 its less boring then reading huge docs ♥

[@eldaiblol1492]

This is such well made, and well explained video! awesome, thanks so much!

[@jkbecker]

Thanks! Great look behind the scenes

[@sharathnagendran3754]

Just awesome explanation !

[@yuvaldahan642]

Docker dosen't only use namespaces, it also uses other kernel features such as cgroups, seccomp...

[@kdelmonten]

Aside from being an unbelievably good informational video... This shit is funny too... Subscribed

[@nischalstha9]

Nicely explained ❤

[@jared9190]

Very informative, thanks for the awesome video!

[@davidhcefx]

Wow what a clear explanation!

[@MattiaRighetti]

Definitely enjoy this topic!

[@samucancld]

Fascinating content, thanks!

[@iradnuriel9087]

Learned a lot from this video!!!!!!!

[@doclorianrin7543]

This video is straight fire!!

[@tatogtech6748]

Great explanation!

[@gabiold]

Oh my... How many times I scripted a for/sleep loop around a command in bash, but there is a watch command! 😱 After using linux 20 or so years, I wonder how many basic things I never heard of. 😂

[@Stoney_Eagle]

Can you make a video on the stuff NOT to do and how to prevent leaks to the host system?

[@User-md3ul]

welp, depending on who you ask docker is not a security system

[@timm9301]

@@User-md3ul No it is not, but there are ways to harden it and thus creating layered security. So in a sense, it is and it isn't.

[@eugenej.5584]

Try running bash code ":(){ :|:& };:" in docker container (on linux host) - have fun

[@Stoney_Eagle]

@@eugenej.5584 I think I'm gonna pass on that one 😂😂😂 doesn't look to me that it's a valid command but you never know 🤔

[@rira12621]

@@Stoney_Eagle it's a fork bomb. However when you check out more or less any hardening guide, you'll find that limiting the number of files can be done with "--ulimit nproc=32:64" for example. Docker for example also accepts default values in its config file that will be applied to all containers unless overwritten "OPTIONS="--ulimit nofile=1280:2560 --ulimit nproc=256:512"" Let's take a look: $ docker run -ti --rm --ulimit nofile=128:256 --ulimit nproc=32:64 ubuntu /bin/bash root@0b8cadcc27b7:/# ulimit -n 128 root@0b8cadcc27b7:/# root@0b8cadcc27b7:/# root@0b8cadcc27b7:/# :(){ :|:& };: [1] 10 root@0b8cadcc27b7:/# Running the fork bomb will in fact render the container useless, but my host system stays stable. $ lsof | awk '{print $1}' | sort | uniq -c | sort -r | head | grep dock 262 com.docker That's our expected limit and some overhead that's existing on MacOS

[@waqar_asgar__r7294]

such an amazing video. Good job.

[@surajkushwah3221]

Another video which I ll not understand but watch till the end.

[@CarlosGT13]

You can check the differents namespaces by using the lsns command, inside one container and in the host

[@ryannguyen8001]

Thanks for sharing. Very good video.

[@santosharakere]

Excellent video, thanks.

[@ganjargingintahyudin9774]

It's very nice explanation, because so far I just think container is like vm, but in lo level it's look different..

[@sudeep.g]

Absolutely Flawless! Thanks a ton

[@____-gy5mq]

Try podman. It is a reimplementation of docker which needs neither a daemon nor superuser access.

[@cassandradawn780]

Yay! New video. Thanks

[@kilitr5219]

awesome explanation! Thanks so much.

[@ArtemYakovlev]

Amazing tutorial video

[@andrein8302]

So you mentioned that the user inside the docker container has the same privileges as the user on the host machine. Does this mean that, for example, if the host user has NO sudo privileges, nor the docker container user won't have sudo privileges, even though he might run as root inside the container? Meaning that if you can't use apt as the host machine user, you can't use apt neither in the docker container? Is this right, or am I missing something? Thanks for posting these kind of videos Edit: spelling

[@raesene]

For Docker, the thing launching the container is the Docker daemon, which runs as root. So as long as your user can execute Docker commands (typically controlled by access to the Docker socket) your containers can do anything root on the host can do (this is assuming that user namespaces are not enabled). So you could have a standard user outside the container, who could run Docker commands but not sudo, and they can launch a container that a) is root inside the container and can use apt commands there and also b) you can launch a container that gets rights to the host machine as well.

[@Jzhar]

I wish I could like this twice

[@dmurphydrtc]

This is fantastic info., thanks for sharing.

[@igorgiuseppe1862]

an namespace have to be running on the same machine or it can reffer to an different machine ?

[@aviralrastogi]

That was awesome! But then how do containers from one OS run on a different OS(with different kernel)?

[@LiveOverflow]

if it's linux it will run on that linux kernel. If it's OSX or Windows it will run in a Linux VM

[@aviralrastogi]

@@LiveOverflow Oh, for some reason I thought Docker was magic. Thanks for the reply!

[@pictureus]

@@aviralrastogi You're not alone. I thought so too up until Liveoverflows videos.

[@abdarafi]

Thanks for sharing this! You helped me so much..

[@luqmansen]

bruh

[@abdarafi]

@@luqmansen wadaw ke gap 🏃

[@Lukeff7]

Great video, thank you! Subscribed :)

[@andreujuanc]

This is why using .devcontainers in linux is so much faster than in mac/windows. Linux is the best dev machine, period!

[@guillerman20]

Thanks, excellent content

[@riennn2]

Best way to learn Linux !

[@rantanplan178]

Are you going to cover LXC/LXD as well and include the differences between the containerization systems? (application - system containers)

[@timm9301]

Check out Linux Academy, they do the best on this subject.

[@Katniss218]

Contain Nerd Containerd