Docker Is Weird

TL;DR

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

A developer’s Oct. 22 post, “Docker is weird,” recounts lessons from an early project to build a container runtime. It explains that containers are restricted processes built from Linux kernel features, while noting that the post is a personal technical account, not a new Docker release or independent security assessment.

A developer building a container runtime as a personal project has published an account of the Linux mechanisms beneath Docker, explaining that containers are processes isolated through kernel features rather than virtual machines. The Oct. 22 post is a technical learning report, not an announcement of a Docker product change, but it highlights why container behavior and security depend on how the host operating system is configured.

In the post on codeandcake.dev, the author writes that a container is still a process running under the host’s Linux kernel. The process can be found through the host’s /proc filesystem, although namespaces and other restrictions change what it can see and do. The author’s shorthand is that “containers aren’t real”: they are not separate virtual machines with their own kernels.

The author describes container isolation as a combination of kernel functions, rather than a single feature called “containers.” Namespaces limit visibility into system resources, while cgroups control or account for resource use. Networking isolation also requires additional mechanisms. The post does not provide a full account of Docker’s implementation and says the author does not yet understand all of the networking details.

The report also says container images are stored as filesystem data. When a container starts, its process uses the image’s files as its root directory, with tools such as chroot or pivot_root involved in changing that view. The post uses a command that launches Bash from an Ubuntu image to illustrate the sequence: obtain the image, place its files on the system, and start a process using those files.

Why Container Internals Matter

The account offers a practical reminder that containers share the host kernel. That distinction matters to developers deciding whether a container provides the same separation as a virtual machine: it does not. Containers can isolate processes and limit access, but their behavior relies on operating-system facilities and the configuration of the runtime and host.

The author also points to the privileges required by container runtimes. The post says Docker’s daemon usually runs as root on Linux because many relevant kernel interfaces require, or historically required, elevated permissions. It adds that rootless container approaches exist, while suggesting networking can be a particular challenge because user-space networking may be needed to reproduce expected features. These are the author’s observations, not a complete comparison of current Docker configurations or a security audit.

For readers who use containers, the main value is conceptual: an image is not a miniature computer, and starting a container does not create a new kernel. Understanding that model helps explain why permissions, kernel isolation and networking choices matter when deploying software.

From Docker Use to Runtime Study

The post is framed as a report from someone who uses Docker, including on macOS, and decided to write a container runtime to learn how the technology works. The author says the project is at an early stage. The article therefore mixes explanations of established Linux concepts with the author’s own discoveries and areas of uncertainty.

It also discusses runc, the container runtime identified in the post as written in Go. The author says Go’s multithreaded runtime complicates some operations, because certain Linux system calls need to run in a single-threaded environment. The post describes runc using a C component before Go initializes and a re-execution of /proc/self/exe to approximate the child-process behavior the author says a runtime needs. These details are presented as the author’s explanation of implementation choices, rather than as a formal assessment of Go or runc.

The source is a single developer’s firsthand account. It does not report a newly discovered Docker vulnerability, a change in Docker’s behavior, or an industry-wide finding. Its contribution is an accessible explanation prompted by the author’s ongoing project.

““Containers aren’t real.””

— The author of the codeandcake.dev report

Limits of the Author’s Findings

The report does not specify which Docker version, Linux distribution, or runtime configuration underlies each observation. Its discussion of root privileges and rootless networking is not a comprehensive description of every current setup; the author explicitly says some networking details remain outside their understanding. The post also does not test security boundaries or compare performance across runtimes.

The author says their own runtime project is still early. No implementation results, release plans, benchmarks, or independent review are provided. Readers should treat the article as a personal technical account, not as evidence of a newly identified flaw in Docker or runc.

The Runtime Project Continues

The author says they have only just started building their own runtime, so the next development described is continued work on that project. The post names no launch date, planned feature set, or upcoming technical milestone. Further detail would be needed to assess how the author’s implementation handles isolation, privileges and networking compared with established runtimes.

For now, the report stands as a learning account rather than a product update. Any claims about the project’s capabilities or implications for Docker security remain unestablished until the author publishes implementation details or testing.

Key Questions

Is Docker a virtual machine?

No. The report explains that containers are processes using the host’s Linux kernel, with isolation provided by kernel features. A virtual machine runs a separate operating-system kernel.

What Linux features help isolate containers?

The post names namespaces, which limit what a process can see, and cgroups, which manage resource use. It also notes that networking relies on additional mechanisms.

Does the post report a Docker security flaw?

No. It is a developer’s account of learning about container internals while starting a runtime project. It does not identify or test a specific security vulnerability.

Why does the author discuss root privileges?

The author says Docker’s daemon usually runs as root on Linux because container runtimes use kernel interfaces that require, or historically required, elevated permissions. The post also notes that rootless setups can involve networking trade-offs, but does not compare all configurations.

Source: hn