{
  "id": 13921679,
  "title": "A container in 81 lines of Bash: what the kernel primitives cost on Ubuntu 24.04",
  "url": "https://urgent.news/2026/10/12/a-container-in-81-lines-of-bash-what-the-kernel-primitives-cost-on",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-12T09:35:46.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/gjstoychev/a-container-in-81-lines-of-bash-what-the-kernel-primitives-cost-on-ubuntu-2404-gkm"
  },
  "original_language": "en",
  "account": "This article details the construction of a container using only kernel primitives in a Bash script, written for Ubuntu 24.04. The author, who is transitioning back to infrastructure work, starts from scratch to build a container, documenting each step and the resulting measurements. The container is built using namespaces, cgroups, a root filesystem, and a virtual network cable. The author performs six checks to ensure proper isolation and functionality:\n\n1. The shell is PID 1 and ps only lists container processes.\n2. The hostname inside the container differs from the host, and ls / reveals Alpine rather than the host OS.\n3. A process exceeding memory limits is killed, and oom_kill 1 is recorded in memory.events.\n4. Ping from the container to the host works over a veth pair.\n5. lsns shows distinct namespace inodes for the container.\n6. The script cleans up after itself, removing any leftover resources.\n\nThe author uses Alpine minirootfs 3.24.2, a 3.7 MB tarball extracted to 8.7 MB. They verify integrity with a checksum and leave a GPG signature for future labs. The script covers UTS namespace (hostname isolation), PID namespace (fork flag importance), and mounting filesystems. The results show distinct namespace inodes for the container and demonstrate that the host filesystem remains intact outside the container.",
  "summary": "Early in this lab I had a shell that was PID 1, and from that same shell ps listed systemd as PID 1. Both were right. The kernel had put the shell in a new PID namespace; ps was still reading a /proc mounted for the host. Isolation and what the tools report are two different things, and that gap is where most container debugging happens. This is the first post in a series about building AI…",
  "key_points": [
    "Container built using only kernel primitives in Bash script for Ubuntu 24.04",
    "Six isolation checks performed: hostname, filesystem, memory limits, network, namespaces, cleanup",
    "Alpine minirootfs 3.24.2 used, container processes isolated from host processes"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}