Docker is weird
Building a small container runtime makes Linux containers feel less magical: they are ordinary processes constrained by namespaces, cgroups, filesystem roots, and networking setup—not a single “container” kernel feature. The author also sketches how images become filesystems and how runc works around Go runtime constraints when setting up a child process.
The article is an early-stage learning exercise, not a full account of Docker or container security. Lobsters commenters added important context: OCI image extraction must handle whiteout markers and storage-driver details; rootless networking can require userspace machinery; and Linux namespace behavior is more complicated than the article’s introductory treatment suggests. Discussion also pointed to a proposed kernel “cells” abstraction and disagreed over how much Docker’s early design shaped today’s container ecosystem.