Docker Is Weird

An engineer built a simple container runtime for fun and summarizes surprising lessons about how Docker actually works. Containers are not lightweight virtual machines but ordinary processes constrained by kernel features; you can find them in /proc because the kernel still runs those processes. There is no single “container” kernel feature - containers are composed of namespaces for isolation, cgroups for resource limits, and a separate, complex layer of networking mechanisms to isolate container network stacks.

Practical consequences show up in images, runtimes, and privileges. Images are essentially filesystem trees placed somewhere on the host and then made the process root via chroot or pivot_root. Docker’s default runtime, runc, is implemented in Go, which complicates low-level syscalls: Go’s multi-threaded runtime and lack of a traditional fork require a small C bootstrap for single-threaded syscalls and a self-exec trick (via /proc/self/exe with a marker) to emulate fork/exec behavior. Docker daemons historically need root to call many kernel APIs, and rootless modes must reimplement networking in userspace to match features. Reimplementing familiar tools proved an effective way to learn these hidden details.