Docker Deep Dive 1: Containers Under the Hood (Namespaces & Cgroups)

Lab 13 of 20 · Docker Internals · 5 hands-on activities · bilingual (English + සිංහල)

පිටුව 13: Docker රහස් 1: Container එකක් කියන්නේ VM එකක් නෙවෙයි! Linux Namespaces සහ Cgroups

Container එකක් ඇතුළේ ඇත්තටම වෙන්නේ මොකක්ද? Linux Kernel Namespaces (PID, NET, MNT, UTS), Cgroups (CPU & RAM සීමා කිරීම), සහ Containers vs VMs සන්සන්දනය.

Architectural Foundation & Systems Diagram

A container is NOT a mini Virtual Machine. A container is simply a standard Linux process that has been isolated using two fundamental Linux kernel features: Namespaces and Control Groups (cgroups).

• 🔮 Linux Namespaces (Isolation) — Creates the illusion that the container is the only OS running:
  • PID: Container thinks its process is PID 1!
  • NET: Dedicated virtual network interfaces & IP.
  • MNT: Isolated filesystem mount points.
  • UTS: Isolated hostname.

• 🛑 Control Groups (cgroups) — Resource metering and enforcement. Prevents any single container from hogging 100% of host CPU cores, exhausting RAM, or bringing down the entire server.

• ⚙️ Docker Engine & containerd — The Docker CLI talks via REST API to dockerd, which invokes the containerd and runc runtime to instruct the Linux kernel to create the namespaces and cgroups.

Step-by-step practical lab

Step 01: Inspect Linux Kernel Namespaces Isolating Processes

සිංහලෙන් — Container එකක් හුදකලා (Isolate) කර තබන Linux Kernel Namespaces පරීක්ෂා කරමු.

Inspect the active namespace file descriptors (ipc, mnt, net, pid, user, uts) that give containers their isolation illusion.

ls -l /proc/$$/ns

• /proc/$$/ns : වත්මන් Shell process එකට අයත් Linux Kernel Namespaces ලැයිස්තුව පෙන්වයි.

Expected output

lrwxrwxrwx 1 sre-engineer devops 0 Sep 16 13:00 ipc -> 'ipc:[4026531839]'
lrwxrwxrwx 1 sre-engineer devops 0 Sep 16 13:00 mnt -> 'mnt:[4026531840]'
lrwxrwxrwx 1 sre-engineer devops 0 Sep 16 13:00 net -> 'net:[4026531992]'
lrwxrwxrwx 1 sre-engineer devops 0 Sep 16 13:00 pid -> 'pid:[4026531836]'
lrwxrwxrwx 1 sre-engineer devops 0 Sep 16 13:00 uts -> 'uts:[4026531838]'

Step 02: Verify Docker Client & Server Engine API Version

සිංහලෙන් — Docker Client සහ Docker Server Engine අනුවාද පරීක්ෂා කරමු.

Query Docker Client and Engine API versions, Go runtime compilation version, and Git commit hash.

docker version

• version : Client CLI එක සහ background dockerd daemon එක අතර API compatibility පෙන්වයි.

Expected output

Client: Docker Engine - Community
 Version:           26.1.4
 API version:       1.45

Server: Docker Engine - Community
 Engine:
  Version:          26.1.4
  Storage Driver:   overlay2
  Cgroup Driver:    systemd
  Cgroup Version:   2

Step 03: Audit System-Wide Docker Telemetry & CGroup Driver

සිංහලෙන් — Docker Storage Driver (overlay2) සහ Cgroup Version එක බලාගනිමු.

Inspect system-wide Docker engine telemetry: storage driver (overlay2), cgroup driver (systemd), container count, and CPUs.

docker info

• info : Docker එන්ජිමේ සම්පූර්ණ පද්ධතිමය දත්ත සටහන ලබා දෙයි.

Expected output

Containers: 2
 Running: 2
 Images: 4
Server Version: 26.1.4
Storage Driver: overlay2
Cgroup Driver: systemd
Cgroup Version: 2
Kernel Version: 6.8.0-45-generic
CPUs: 4
Total Memory: 7.685GiB

Hands-on practice activities

Work through these yourself — tick them off as you go.

• Activity 61: Inspect Process Linux Kernel Namespaces (Drill) — Inspect the active namespace file descriptors (ipc, mnt, net, pid, user, uts) that isolate processes.
• Activity 62: Query Docker Engine Version and API (Drill) — Verify Docker Client, Docker Server Engine, API version, and Git commit hash.
• Activity 63: Inspect System-Wide Docker Telemetry (Drill) — Display total containers, images, storage driver (overlay2), and CGroup version (v2).
• Activity 64: Understand Container Kernel Sharing (Checkpoint) — A container CANNOT run a Windows kernel on a Linux host, because containers share the underlying Linux kernel!
• Activity 65: Linux Namespaces Function Quiz (Quiz) — Which Linux kernel feature provides process, network, and mount isolation for containers? Answer: Linux Namespaces.

Keep going: ← Lab 12 · Lab 14 → · Track your progress in the Self Guide