Container runtime from scratch

This folder contains a basic container runtime management system built from scratch, based on my own studies. As of now, following basic features are implemented:-

• Isolation of network, process and mountspace view using namespaces
• Rooted (No user isolation)
• Rootless (user isolation)
• Multi container management system based on this runtime

Future commits will include :-

• Configuration file based container builds
• Resource limiting using Cgroups

Topics learned or explored while building this project :-

• Go language
• Resource isolation and limiting in Linux-based OSes
• Nuances of privileged vs unprivileged containers on host systems
• Daemon based development

Started initially as a small project, but migrated to its own repo as the size of the project increased.

Running the project

1. Install dependencies

go mod download

2. Get the minimal ubuntu-image FS for changing root (this requires bash in the container)

mkdir ubuntu && cd ubuntu && curl https://cloud-images.ubuntu.com/minimal/releases/noble/release/ubuntu-24.04-minimal-cloudimg-amd64-root.tar.xz -o ubuntu-fs.tar.xz && sudo tar -x -f ubuntu-fs.tar.xz

3. Build the binary (reqd. for rooted running for now) and run the container

go build -o dockerman main.go
# Command format
# dockerman run <image> <cmd> <args...>
sudo ./dockerman run ubuntu -- /bin/bash # for an interactive shell
sudo ./dockerman run ubuntu -- /bin/bash -c date # for running a command in a container

3. (Rootless) This can be run as an unprivileged user.

sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0 # Ubuntu-specific
# This disables apparmor protection for restricting unprivileged user namespaces, used in many exploits.
# Do at your own risk
./dockerman run ubuntu -- /bin/bash

4. Entering into a container (Requires root)

./dockerman daemon # requires the backend server running in background
./dockerman run --name smth ubuntu -- /bin/bash # Works with both rooted and rootless container
sudo ./dockerman exec smth -- /bin/bash

Some major sources I used for studying

• Liz Rice's Container from Scratch
• Red Hat Blog's posts on container
• Jerome Petazzoni's talk on containers
• Random strangers on Reddit and Medium whose explanation solidified the foundations more from the above sources.