Containers look like lightweight VMs, but they’re really just processes wrapped in namespaces and cgroups. We unpack mount, PID, network, UTS, IPC, user, and cgroup namespaces, trace how runtimes like containerd wire them together, and explore the failure modes every SRE should know.
Namespaces are the unsung kernel feature behind every container runtime. This post walks through the eight namespace types, how they appear in the kernel, and how Docker, Kubernetes, and runc compose them into the isolation boundary you trust in production.
Build a working container runtime in roughly 300 lines of Go, using Linux namespaces and cgroups. A side project that signals real systems engineering chops on a CV.
A hands‑on look at each Linux namespace, how they interlock to create container isolation, and practical patterns for deploying them at scale.
A practical guide to Linux namespaces, showing how they power containers, with architecture diagrams, code snippets, and production tips.