Operating Systems · Cluster
Isolation and Namespaces
Containers, chroots, and resource limits.
- 01 Chroot Confines Path Resolution, Not the Process What the chroot call changes in the kernel, why a process that keeps a directory descriptor can walk out of the new root, and which guarantees the call does and does not provide.
- 02 Mount Namespaces and the Propagation of Mount Events How each process gets its own mount table, why a mount made in one namespace can appear in another, and what the shared, slave, private and unbindable propagation flags actually control.
- 03 PID Namespaces and the Special Status of PID 1 How PID numbers become per-namespace identifiers, why the first process in a new namespace cannot be killed from inside it, and how namespace teardown depends on that process exiting.
- 04 User Namespaces and the Mapping of UIDs How a process can hold full privilege over a subtree of the process hierarchy while holding none outside it, and what the uid_map translation table does at each syscall boundary.
- 05 Network Namespaces and Virtual Ethernet Pairs How a process gets a private set of interfaces, routes and firewall rules, and how a veth pair connects that private stack to the host without either side sharing a socket table.
- 06 Control Groups v2: How Memory and CPU Limits Are Enforced Where the kernel charges a page to a cgroup, what happens when the charge exceeds the limit, and why CPU bandwidth control throttles rather than blocks.
- 07 Capabilities and the Decomposition of Root Privilege How the single root check was split into distinct capabilities, how the permitted, effective and inheritable sets interact across execve, and why file capabilities and no_new_privs change the rules.
- 08 seccomp-BPF and the Filtering of System Calls How a BPF program attached to a process inspects syscall numbers and arguments before dispatch, why argument filtering cannot dereference pointers, and what the return actions cost.
- 09 Assembling a Container Root with pivot_root and Overlay Mounts Why chroot is the wrong tool for changing a container root, how pivot_root swaps the namespace root atomically, and how an overlay upper layer turns a read-only image into a writable filesystem.
- 10 Time Namespaces and the State That No Namespace Covers How a time namespace shifts the monotonic and boottime clocks without changing the wall clock, and which kernel resources remain global no matter how many namespaces a process joins.