Linux Container Primitives: cgroups, namespaces, and more!

Samuel Karp
Amazon Web Services
In this session, we’ll explore the different Linux primitives that are commonly used in implementing container runtimes. We’ll learn about the Linux primitives that underlie container runtimes like Docker, including cgroups, namespaces, and union filesystems. We’ll see how Docker uses these primitives, and how the OCI standard makes it possible to customize how your containers run. We’ll also discuss alternative container runtimes like CRI-O, rkt, and systemd-nspawn and what makes them different. This will be an interactive session with a live demo and open questions.

[@timlind3129]

3 years later; this is still an excellent overview.

[@eliyahkaz]

this is the best explanation of cgroups i have seen so far, seeing things makes understanding them so simple 👍

[@cvical]

Super! A lot covered in 30+ mins. I needed to stop several times because it gold what’s in there.

[@kaneding9299]

I cannot explain how useful this is. Thank you sincerely.

[@kaidaniel4579]

By far the best (and there are many) explanation I could find on the internet. Detailed yet clear and great precise narration.

[@shakhawat41]

Advance level details coupled with demos - great job.

[@sanikashah5755]

Awesome! Took long time to watch it, lot of information in 30 minutes. I would have to watch multiple times to understand it, since I am kind of new to this! Thanks for the demos as well. They make it easier to understand : )

[@lienecirule4342]

Eye opening video. Advanced and most importantly - understandable.

[@blumki]

Very intuitive. Must watch for all the software engineers working in the current virtual software world

[@davidkillmon7242]

This is such an awesome explanation! Thanks Sam!

[@kirillsaltanov4586]

One of the best video i ve seen about cgroups

[@TheNullBox]

the introduction to cgroups were great.

[@TheDiveO]

minor correction: the procfs links to namespaces aren't symbolic links, even as they look like them. They're something else because they have a reference counted relation to the nsfs where the namespace inodes (numbers) are allocated and released. By bind mounting these references, you can keep process-less namespaces alive, which you cannot do using symbolic links: the namespaces would be garbage collected.

[@shulyakav]

Excellent! Thank you, Sir.

[@erickmanuelbazansalinas9705]

thank you sir!, this has been a great explanation!

[@thebsv]

This was excellent. Thank you!

[@icodevpi]

Thank you very much, great content.

[@ArchonLicht]

Awesome talk, thank you very much!

[@mads7401]

Thanks, great explanation :)

[@vagueanxiety42]

thanks! it is packed with info and I had to pause multiple times to digest it. (I was a little confused by unshare syscall and unshare util....

[@carloszavaleta]

this was awesome - thanks!

[@mohammadmottaghi4369]

Nice Nice ! Good job ! minor improvement would be to highlight the dir-names during your demo so people can spot them faster.

[@tigrangevorgyan3584]

Thanks! This was useful to me!

[@ankk98]

Need to watch it again with focus

[@friedbrainz7998]

Bit late, but I loved your video.

[@rohitmishra6402]

To execute redis binary on the host, is it necessary to enter mount ns? What about just doing sudo /proc//exe without nsenter, it does the same, because exe is really a symbolic link to the redis-binary on the container file system, amazing video in between, so good to watch with everything explained clearly and crisply.

[@kaveh6161]

That was awesome 🤗

[@tianhepeng9162]

I can only understand some about the cgroup parts. The rest are too unfamiliar for me. You guys can understand all 3 sections?

[@kirillsaltanov4586]

If it is possible please provide the same style video about hooks for the container, how play on them. thanks

[@marcello4258]

super valuable video! thanks a lot

[@fsamobby]

wow that's kinda lit!!

[@clee7408]

Excellent!

[@khongmunhing6948]

Thanks. I love your explanation. I give me to understand more. Do you have your own youtube channel that I can subscribe it?

[@user-bh2rd1dz1z]

Reading from a script and no explanations? I can do that too. If I put each of your chapters into chatGPT I get more informative explanations than this mess of a presentation...

[@imagineabout4153]

I cannot explain how useful this is. Thank you sincerely.