A container in 81 lines of Bash: what the kernel primitives cost on Ubuntu 24.04
Early in this lab I had a shell that was PID 1, and from that same shell ps listed systemd as PID 1. Both were right. The kernel had put the shell in a new PID namespace; ps was still reading a /proc mounted for the host. Isolation and what the tools report are two different things, and that gap is where most container debugging happens. This is the first post in a series about building AI…
This article details the construction of a container using only kernel primitives in a Bash script, written for Ubuntu 24.04. The author, who is transitioning back to infrastructure work, starts from scratch to build a container, documenting each step and the resulting measurements. The container is built using namespaces, cgroups, a root filesystem, and a virtual network cable. The author performs six checks to ensure proper isolation and functionality:
1. The shell is PID 1 and ps only lists container processes.
2. The hostname inside the container differs from the host, and ls / reveals Alpine rather than the host OS.
3. A process exceeding memory limits is killed, and oom_kill 1 is recorded in memory.events.
4. Ping from the container to the host works over a veth pair.
5. lsns shows distinct namespace inodes for the container.
6. The script cleans up after itself, removing any leftover resources.
The author uses Alpine minirootfs 3.24.2, a 3.7 MB tarball extracted to 8.7 MB. They verify integrity with a checksum and leave a GPG signature for future labs. The script covers UTS namespace (hostname isolation), PID namespace (fork flag importance), and mounting filesystems. The results show distinct namespace inodes for the container and demonstrate that the host filesystem remains intact outside the container.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
