Isolation

What a container is hiding, and what it is sharing

Each namespace and what it hides, root in the container against root on the host, and dropping capabilities instead.

A process with a funny view

There is no such thing as a container in the kernel. There is a process, and a set of namespaces that change what it can see, and a cgroup that limits what it can use.

A mount namespace rooted at the image's layers plus a writable layer. A pid namespace that makes your process PID 1 and hides everything above it. A net namespace with its own interfaces. That is the whole trick.

Which is why --net=host is not a special mode: it is simply not giving the process a net namespace, so it sees the host's.

Dockerfile

Layers

Nothing has been built yet. Press Build and the layers, the digest and the cache ledger appear — not before.