{
  "id": 7282869,
  "title": "A container is just a process with a few private views. I built one in thirty lines.",
  "url": "https://urgent.news/2026/09/14/a-container-is-just-a-process-with-a-few-private-views-i-built-one-in",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-14T08:50:00.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/remdore/a-container-is-just-a-process-with-a-few-private-views-i-built-one-in-thirty-lines-26di"
  },
  "original_language": "en",
  "account": "A container is essentially a process that has been granted a few private views of the host system's resources. This concept puzzled the author for years, as they could not articulate what exactly constituted a container. However, after building one themselves, they discovered that it is not a complex process but rather a straightforward request to the kernel for specific views.\n\nThe key to creating a container lies in Linux's namespace feature, which provides a private copy of global resources such as process ID (PID), mount points, network stack, /etc/hostname, inter-process communication (IPC), and user information. The author built a container using thirty lines of code, without relying on Docker. Each line of code requested a specific namespace to isolate the process from the host system.\n\nThe isolation is achieved through various flags passed to the unshare command. The --uts flag gives the process a private hostname, enabling it to change its name to \"container\" without the host noticing. The --pid and --fork flags create a private process table, with the child process becoming PID 1. The --net flag sets up an empty network stack with a single loopback interface, while the --mount flag provides a private set of mounts, allowing the process to swap its root filesystem.\n\nThe most challenging step in creating a container is assigning a different root directory to the process. The obvious approach is to use chroot, but it is not foolproof, as a privileged process can still escape. Instead, the author used pivot_root, a syscall that swaps the root mount and unmounts the old root completely, preventing any escape routes. This step necessitates specific conditions, such as the new root being a mount point and the parent mount being private.\n\nOnce the container's filesystem is set up, the author demonstrated the effectiveness of the isolation by running processes inside the container. They observed that the container had only two processes, while the host had several dozen, confirming the success of the isolation. The isolation is achieved through namespaces, while cgroups limit the resources the container can consume. The author emphasized that isolation and resource limitation are two separate aspects of containers, with cgroups governing the latter.",
  "summary": "Here is a thing that bothered me for years without my quite admitting it: I did not know what a container actually was. I knew how to run one. I could not have told you what the kernel does when you start one, because the honest answer is that there is no such kernel object to point at. A container is just a normal process that has been handed a few private versions of things it would otherwise…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}