Anatomy of containers
Containers have been in existence for more than 10 years. Fundamentally, containers are part of Linux, or a feature of Linux, and they are processes that run on Linux. But these processes are isolated from other processes on the same host OS.
Containers are isolated because of some components, such as namespaces, cgroups, and SELinux. These components make containers secure and enterprise-grade. The following figure shows the components of a container:
Figure 2.4 – Container components
Let’s look at the components shown in the preceding diagram in more detail:
- Namespaces: Namespaces limit what the process can see and are created with syscalls. Namespaces are used by the Linux kernel to provide process isolation.
- Cgroups: Because containers run on a single host, it’s always a worry that one or more containers can consume a large amount of resources, thus depriving other containers. cgroups ensure...
