Docker's core technology: Linux's namespace

Docker is an open source containerization platform based on the core technologies of the Linux operating system, one of which is Linux's namespace. Namespace is an isolation mechanism provided by the Linux kernel that isolates system resources, so as to isolate resources such as processes and file systems in containers from the host. This article will introduce Linux's namespace technology and provide C code examples to illustrate how it works.

Linux Namespace

Namespaces are a feature of the Linux kernel that allows system resources to be isolated so that different processes can have their own independent views. By using namespaces, Docker can create an independent runtime environment in which processes, file systems, network interfaces, and other resources are isolated from each other.

Linux namespaces provide several different isolation mechanisms:

• PID Namespace: Each process has a unique process ID (PID) in the PID namespace. Processes in different namespaces can have the same PID, but are unique within their respective namespaces.
• Mount Namespace: Each namespace has its own view of the file system. In different namespaces, the same file system path may point to different files or directories.
• UTS Namespace: UTS (Unix Timesharing System) Namespace is used to isolate system identifiers such as host names and domain names. Different namespaces can have different hostnames.
• Network Namespace: Each namespace has its own network interface and IP address. Network interfaces in different namespaces can have the same IP address, but are unique within their respective namespaces.
• IPC Namespace: IPC (Inter-Process Communication) Namespace is used to isolate resources for interprocess communication, such as shared memory, semaphores, and message queues.

By using these different namespaces, Docker can achieve container isolation and resource management, providing an independent operating environment and efficient resource utilization.

C code examples

Below is a simple C code example that shows how to use the Linux namespace to create an isolated process environment.

#include <stdio.h>
#include <sched.h>
#include <unistd.h>

#define STACK_SIZE 1024 * 1024

static char child_stack[STACK_SIZE];

int child_function(void *args) {
    printf("Child process - PID: %d\n", getpid());
    sleep(5);
    printf("Child process exiting\n");
    return 0;
}

int main() {
    printf("Parent process - PID: %d\n", getpid());

    int child_pid = clone(child_function, child_stack + STACK_SIZE, CLONE_NEWPID | CLONE_NEWUTS | SIGCHLD, NULL);
    if (child_pid == -1) {
        perror("clone");
        return 1;
    }

    printf("Parent process - Child PID: %d\n", child_pid);

    sleep(10);

    return 0;
}           

In the above code, we used the clone system call to create a new process and create an isolated PID Namespace and UTS Namespace by setting the CLONE_NEWPID and CLONE_NEWUTS flags. In the child process, we print the PID of the child process and let it sleep for 5 seconds before exiting. In the parent process, we print the PID of the child process and let the parent process sleep for 10 seconds before exiting.

Run the above code, and you'll see that the parent and child processes have different PIDs, and the child process exits before the parent process.

This simple example shows how to use Linux namespaces to create an isolated process environment. In actual Docker, these namespaces are combined with other isolation mechanisms to achieve more comprehensive container isolation.

conclusion

Linux Namespace is one of Docker's core technologies, providing an isolation mechanism that allows Docker to create an isolated runtime environment. By using different namespaces, Docker can isolate resources such as processes, file systems, and network interfaces. This article introduces the Linux namespace technology and provides a C code sample to illustrate how it works. Understanding Linux's namespaces is important to understand how Docker works and implement container isolation.

From: Scientific Caprice