Containers Internals

Purpose

Guide agents through Linux container internals: namespaces (clone, unshare, nsenter), cgroups v2 resource limits, overlayfs storage, runc and the OCI runtime spec, seccomp-bpf filtering, Linux capabilities for privilege dropping, and container escape mitigations.

When to Use

• Understanding how Docker/Podman isolate processes under the hood
• Debugging container resource limits (OOM, CPU throttling)
• Writing custom seccomp profiles for sandboxed workloads
• Building minimal containers without Docker
• Investigating container escape vulnerabilities
• Tuning cgroups v2 for Kubernetes pods

Workflow

1. Namespaces