Deep Dive into Docker : Part 1
Tags: docker, devops, beginners, tutorial
Published: 2022-10-21 17:03:55


> **Before we dive into learning about Docker, it's important to have a basic understanding of containers.**

## What is Container?
Isolated area of OS with resource usage limit applied.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gw1t8xuaezlmbr9am1hf.png)

We use two main building blocks when we're building containers.

1. Namespaces
2. Control Groups

(Both of these are Linux Kernel Primitives)

## Namespaces: 
Namespaces let us take an operating system and carve it into multiple isolated virtual operating systems.

- It is a bit like hypervisors and virtual machines.

In hypervisor world, we take a single physical machine with all of its resources. ( e.g. CPU and RAM ) and we carve out one or more virtual machines.

Each one gets a down slice of virtual CPU, virtual memory, virtual networking, the whole shabang. (All of it, the whole lot)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 

In container world, we use namespaces to take  a single operating system with all of its resources which tend to be higher - level constructs like file systems, process trees and users. We carve it all up into multiple virtual operating systems called **containers**. 

Each container get its own virtual or containerized root file system, its own process tree, its own Etho interface, its own root user, the full monty. (everything)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/49c8k2zk1com3kn4nh1a.png)

Just the way a virtual machine in a hypervisor world looks, taste and smell like regular physical server. In container world each container looks, feels and smells exactly like a Operating System (only it's not).

All the container present are sharing a single kernel on the host, but they all are so isolated. So that the stuff inside the one container doesn't even know about any other.

## LInux Namespaces

- Process ID (pid)
- Network (net)
- Filesystem/mount (mnt)
- Inter-proc comms (ipc)
- UTS (uts)
- User (user)

> An organised collection of these namespaces are basically known as **Docker Container**.


1. pid: 
It gives each container its own process tree complete with its own pid 1. (which means that a process in one container is blissfully unaware of any other container)

2. net:
it gives each container its own isolated network stck, so its own NIC's, IP's, routing tables, the lot.

3. mnt:
It gives a container its own isolated root file system. (e.g. slash on Linux)

4. ipc:
It lets the processes in a single container access the same shared memory, but it stops everything from outside of the container.

5. uts:
It gives every container its own hostname.

6. user:
It lets you map accounts inside of a container to different users on the host. (It is relatively new to docker)
e.g. mapping the container's root user to a non-privileged user on the host.

## Control Groups

> But we need something to police the consumption of system resources also. They are called **Control groups**.

The main idea is to group processes and impose limits. (How much CPU, RAM, disk a container will use)

> With these two technologies, namespaces and control groups, we have got a realistic shot of workable container and a union file system or some way of combining bunxh of read-only file systems or block devices, lashing a writable layer on top and presenting them to the system in a unified view.