A Linux container is a lightweight way to run applications in isolation. Think of it as a "box" where you can run a program, and that program won't interfere with other programs running on the same computer. Containers are built using special features of the Linux operating system, and two of the most important features are namespaces and cgroups.

What are Namespaces?

Namespaces are like "walls" that separate different parts of the system. They create logical partitions of system resources so that processes (programs) running inside a namespace can only see and interact with their own "world." For example:

• A PID namespace isolates process IDs (the unique numbers assigned to running programs).

• A network namespace isolates network interfaces (like IP addresses).

• A mount namespace isolates file systems (like directories and files).

In short, namespaces are what make containers feel like their own little "mini-computers" inside the larger system.

What are cgroups (Control Groups)?

While namespaces isolate processes, cgroups are used to control how much of the system's resources (like CPU, memory, or disk) a process can use. This ensures that one process doesn't hog all the resources and cause problems for other processes.

Example: PID Namespace

Let's focus on the PID namespace to understand how namespaces work.

Normal System View: When you run the ps axf command on a Linux system, it shows a list of all the running processes. Each process has a unique PID (Process ID). For example: PID , TTY ,STAT ,TIME COMMAND

This is the "global" view of all processes running on the system.

Creating a New PID Namespace

Now, let's create a new PID namespace using the unshare command. This command creates a new "box" (namespace) for processes. Here's the command: sudo unshare --fork --pid --mount-proc=/proc /bin/sh

-fork: Starts a new process in the new namespace.

-pid: Creates a new PID namespace.

-mount-proc=/proc: Mounts a new /proc directory for the namespace (this is where process information is stored).

• Notice that the shell process (/bin/sh) now has PID 1, and the ps command has PID 2.

• All other processes from the "global" system have disappeared! This is because the new namespace isolates the processes inside it.

  Checking from Outside: If you open another terminal and run ps axf on the main system, you'll still see all the processes, including the unshare command and the shell process running in the new namespace.
  This shows that the processes in the new namespace are still part of the global system, but they are isolated and cannot see the global processes.

  

Why is Isolation Important?

• The isolation provided by namespaces is useful because it allows you to run programs in their own "box" without interfering with other programs. For example:

  • You can run multiple versions of the same program without conflicts.

  • You can test software in a safe environment without affecting the rest of the system.

The Problem: Resource Usage

Even though namespaces isolate processes, they don't limit how much of the system's resources (like memory or CPU) those processes can use. This can cause problems.

Example:

1. Imagine you have a child namespace with some processes running inside it.

2. These processes start using a lot of memory, eventually using up all the memory available on the system.

3. When the system runs out of memory, the Linux kernel activates the OOM killer (Out-Of-Memory killer) to free up memory by killing processes.

4. The OOM killer might kill processes outside the namespace (in the global system), causing problems for other programs.

   Solution: cgroups

   To prevent this, we use cgroups to limit how much memory, CPU, or other resources a namespace can use. For example:

   • You can set a memory limit for the child namespace so that it cannot use more than a certain amount of memory.

   • If the processes in the namespace try to use more memory than allowed, they will be stopped, and the rest of the system will remain unaffected.

What are cgroups?

• cgroups (control groups) are a Linux kernel feature that allows you to:

  1. Group processes together.

  2. Control and limit how much of the system's resources (like CPU, memory, disk I/O, etc.) those processes can use.

This is useful when you want to ensure that one process or group of processes doesn’t consume too many resources and affect the rest of the system
Example: Limiting CPU Usage with cgroups

Let’s go through the example step by step.

1. Stressing the CPU

First, we run a command that uses 100% of the CPU. The command is:

yes > /dev/null &

• The yes command generates an infinite stream of "yes" and writes it to /dev/null (a "black hole" where data is discarded).

• The & at the end runs the command in the background.

  

  Now, if you monitor the system using the top command, you’ll see that the yes process is consuming 100% of the CPU:

  

  Creating a cgroup for CPU

  To limit the CPU usage of the yes process, we use cgroups. cgroups are organized as directories under /sys/fs/cgroup/, and each directory represents a resource type (e.g., CPU, memory, etc.).

  List available cgroups: ls /sys/fs/cgroup

• 

  The cpu directory is where we control CPU usage.
  Create a new cgroup: We create a new directory under /sys/fs/cgroup/cpu/ to represent our cgroup. Let’s call it box: mkdir /sys/fs/cgroup/box

  Set CPU limit (50%)

• cpu.max = <quota> <period>
  Example: 50% of one core = 50ms per 100ms.

  echo "50000 100000" | sudo tee /sys/fs/cgroup/box/cpu.max

  • 50000 → quota: microseconds of CPU time

  • 100000 → period: how often the quota resets

Assign the process to your cgroup

echo <PID> | sudo tee /sys/fs/cgroup/box/cgroup.procs

Check the CPU usage again: Run top again to monitor the system:

How Does This Work?

• The cpu.cfs_quota_us file sets the maximum amount of CPU time a process in the cgroup can use in a given period.

• The default period is 100,000 µs (0.1 seconds), which is controlled by the cpu.cfs_period_us file.

• By setting the quota to 50000, we are allowing the process to use 50% of the CPU time in each 0.1-second period.

Why is This Useful?

This example shows how cgroups can be used to control resource usage. By limiting the CPU usage of the yes process, we ensure that it doesn’t consume all the CPU and leave other processes without enough resources.

Containers and Isolation

By combining namespaces (for isolation) and cgroups (for resource control), we can create fully isolated environments for applications. These environments, called containers, allow us to:

1. Run applications in isolation (using namespaces).

2. Control how much CPU, memory, and other resources they can use (using cgroups).

This is the foundation of modern container technologies like Docker and Kubernetes.