Container from Scratch

Build a minimal container in Go to understand what Docker does.

A Linux process with three things:

1. Namespaces - Isolate what it sees (PIDs, network, filesystem, hostname)
2. Cgroups - Limit resources (CPU, memory, I/O)
3. Root filesystem - Its own files and libraries

Usage

Linux:

sudo go run main.go run /bin/sh

macOS/Windows:

docker run -it --privileged golang:latest bash
# Then run the code inside

Why? Containers need Linux kernel features that macOS/Windows don't have.

How It Works

1. Parent creates new namespaces
2. Child runs inside isolation as PID 1
3. Process can't see host processes or share hostname

What's Missing

Real containers also have: image layers, networking, security policies, resource limits, OCI compliance.

Resources

• OCI Runtime Spec
• runc Source