[reading Notes] 05 | vernacular Container Foundation (1): speaking from the process

"in-depth analysis of Kubernetes-05 | vernacular Container Foundation (1): from the process point of view"

The implementation of the container mainly applies the mechanism of namespace and cgroups.

In fact, the implementation of namespace is to add a CLONE_NEWPID parameter when calling clone () at the bottom to create a new namespace for the process, shield the pid of other processes, so that it cannot see the real process space on the host, and thus think that it is the main process of pid 1.

Int pid = clone (main_function, stack_size, CLONE_NEWPID | SIGCHLD, NULL)

In addition to PID, namespace isolation of mount, uts, ipc, user and network is also implemented.

PS: from the host's point of view, these namespace-isolated processes are no different from other processes

That is, the process running in the container can be seen on the host.