Does docker share the kernel with the host?

Docker and the host share the kernel; the Docker container is essentially a process on the host. Docker implements resource isolation through namespace. Docker and the host share the kernel essentially through the kernel's namespace and cgroup. Implemented process isolation.

The operating environment of this tutorial: linux7.3 system, docker-1.13.1 version, Dell G3 computer.

Docker and the host share the kernel

Docker and the host share the kernel

The essence is process isolation achieved through the kernel namespace and cgroup

When talking about Docker, we often talk about the implementation of Docker. Many developers know that Docker containers are essentially processes on the host machine. Docker implements resource isolation through namespace. Resource restrictions are implemented through cgroups, and efficient file operations are implemented through the copy-on-write mechanism. But when going deeper into the technical details such as namespaces and cgroups, most developers will feel at a loss. So here, I will first lead you into the Linux kernel and understand the technical details of namespace and cgroups.

namespace resource isolation

If you want to implement a resource isolation container, where should you start? Some people's first reaction may be the chroot command. The most intuitive feeling given to users by this command is that the mount point of the root directory / is switched after use, that is, the file system is isolated. Next, in order to communicate and locate in a distributed environment, the container must have an independent IP, port, routing, etc., so network isolation naturally comes to mind. At the same time, the container also needs an independent host name to identify itself on the network. When I think of the network, I naturally think of communication, and I also think of the need for isolation of inter-process communication. Developers may also have thought about the issue of permissions. The isolation of users and user groups realizes the isolation of user permissions. Finally, the application running in the container needs to have its own (PID), and naturally needs to be isolated from the PID in the host.

Thus, the six isolations required for a container are basically completed. The Linux kernel provides these six namespace isolation system calls, as shown in Table 1-1.

In fact, one of the main purposes of the Linux kernel implementing namespace is to implement lightweight virtualization (container) services. Processes in the same namespace can sense each other's changes and know nothing about external processes. This can give the process in the container the illusion that it is in an independent system environment, thereby achieving independence and isolation.

Recommended learning: "docker video tutorial"

The above is the detailed content of Does docker share the kernel with the host?. For more information, please follow other related articles on the PHP Chinese website!