Containerize

A minimal Linux container runtime written in C++. This project demonstrates how containerization works at the kernel level by using Linux namespaces, chroot, and mount operations to create an isolated environment — similar in concept to Docker, but built from scratch.

How It Works

The program creates a new process in isolated Linux namespaces using the clone() system call with the following namespace flags:

Namespace	Flag	Purpose
UTS	CLONE_NEWUTS	Isolated hostname (minicontainer)
Mount	CLONE_NEWNS	Independent filesystem mount points
PID	CLONE_NEWPID	Separate process ID space
IPC	CLONE_NEWIPC	Isolated inter-process communication
Cgroup	CLONE_NEWCGROUP	Separate cgroup hierarchy
User	CLONE_NEWUSER	Independent user/group IDs

Inside the new namespace, the program:

1. Sets up /tmp/container_root as the container's root filesystem using chroot
2. Mounts a private /proc filesystem for process visibility
3. Sets the hostname to minicontainer
4. Launches an interactive Bash shell

Requirements

• Linux with namespace support (kernel 3.8+)
• C++ compiler (GCC / G++)
• make
• A populated root filesystem at /tmp/container_root (e.g. via debootstrap)

Building

make        # compiles the 'container' binary

Other Makefile targets:

make clean   # remove object files
make fclean  # remove object files and the binary

Usage

./container

This drops you into an interactive Bash shell running inside the container with an isolated hostname, PID space, and mount namespace.

Note: Creating namespaces may require elevated privileges (root or CAP_SYS_ADMIN). You may need to run the binary with sudo.

Preparing a Root Filesystem

The container expects a root filesystem at /tmp/container_root. You can create one with debootstrap (Debian/Ubuntu):

sudo apt-get install debootstrap
sudo debootstrap stable /tmp/container_root http://deb.debian.org/debian/

Project Structure

.
├── Makefile            # Build configuration
├── minicontainer.cpp   # Container runtime implementation
└── Readme.md           # This file