Container Runtimes: Namespaces, Cgroups & Go

Learning Goal: Designing and implementing a minimal container runtime from scratch in Go using Linux namespaces, control groups (cgroups), and overlay filesystems to master operating-system-level virtualization.

Prerequisites: Basic Linux command-line familiarity and general programming logic (variables, loops, basic functions). No prior systems programming experience is required.
Estimated Total Study Time: 32 Hours

Module 1: Linux Systems & Go Programming Foundations

This module establishes a deep mental model of how operating systems work under the hood. You will learn about processes, execution memory spaces, and the system call interface that allows user-space programs to talk directly to the Linux kernel. Simultaneously, you will build core competency in the Go programming language to write system-level utilities.

Knowledge Checkpoint

Explain the difference between User Space and Kernel Space and how system calls bridge them.
Identify the four primary memory areas of an active process (text, data, heap, stack).
Compile and run a basic Go program using variables, control structures, and system package imports.

Module 2: The Core of Isolation: Chroot and Filesystems

Here, you will transition from generic system concepts to the historical ancestor of container filesystem isolation: the chroot system call. You will understand how operating systems map virtual directory paths to physical hardware and how directory jails prevent processes from traversing unauthorized file hierarchies.

Knowledge Checkpoint

Create a custom local rootfs folder structure and trigger a shell inside it using chroot.
Explain how to find shared library dependencies of any compiled binary using the ldd command.
Describe the limitations of chroot security and why it cannot protect network ports or process lists.

Module 3: Linux Namespaces: Process Isolation

This module covers the modern system-level mechanism for process isolation: Linux Namespaces. You will explore how namespaces partition global host resources (processes, networks, users, and mount points) so that individual execution threads believe they have exclusive access to a clean machine.

Knowledge Checkpoint

Name and define the responsibilities of the six primary namespaces: UTS, PID, MNT, NET, USER, and IPC.
Explain why standard multi-threaded Go execution requires thread pinning (runtime.LockOSThread()) when altering process namespaces.
Identify which namespace hides host processes, allowing a container-bound process to see itself as PID 1.

Module 4: Control Groups (cgroups): Resource Limiting

While namespaces hide system resources, Control Groups (cgroups) limit and control resource usage (such as CPU, memory, and disk I/O). This module focuses on configuring limits directly via the virtual filesystem, detailing the differences between cgroups v1 and v2.

Practical Walkthrough: Managing Cgroups in Go

Unlike traditional configuration files, cgroup limits are managed by writing to a virtual filesystem located under /sys/fs/cgroup. To limit memory usage for a sandboxed process in Go:

Create a dedicated control folder: /sys/fs/cgroup/memory/my-runtime/.
Write your process limit (e.g., in bytes) directly into the memory.limit_in_bytes (cgroup v1) or memory.max (cgroup v2) control file.
Write the target sandboxed process ID (PID) into the tasks or cgroup.procs file inside that folder.

package main

import ( "os" "path/filepath" "strconv" )

func LimitMemory(pid int, limitBytes int64) error { cgroupPath := "/sys/fs/cgroup/memory/my-runtime" os.MkdirAll(cgroupPath, 0755)

// Set memory ceiling limit
err := os.WriteFile(filepath.Join(cgroupPath, "memory.limit_in_bytes"), []byte(strconv.FormatInt(limitBytes, 10)), 0644)
if err != nil {
	return err
}
// Assign target process to the group
return os.WriteFile(filepath.Join(cgroupPath, "tasks"), []byte(strconv.Itoa(pid)), 0644)

}

Knowledge Checkpoint

Locate the active cgroup mount path on your Linux host system.
Create a memory limitation control group and assign a running shell to it manually.
Explain the architectural differences in control hierarchies between cgroups v1 and cgroups v2.

Module 5: Overlay Filesystems and Image Layers

This module covers union filesystems, which allow you to mount multiple separate directories as a single unified system. You will explore how OverlayFS implements container layering, using copy-on-write functionality to preserve base read-only templates.

Supplemental Study: Simulating OverlayFS Mounts

To understand the layering behavior before implementing it in Go, run these commands in a Linux terminal:

mkdir lower upper work merged echo "I am from base" > lower/base.txt echo "I am a config" > lower/config.txt

Mount the layers

sudo mount -t overlay overlay -o lowerdir=./lower,upperdir=./upper,workdir=./work ./merged

Verify file visibility

cat merged/base.txt

Modify a file inside merged layer

echo "Modified!" >> merged/config.txt

Verify Copy-On-Write (COW) behavior:

The base layer remains unchanged, while changes are captured in the upper directory.

cat lower/config.txt cat upper/config.txt

Knowledge Checkpoint

Define the roles of the lowerdir, upperdir, workdir, and merged layers.
Explain the copy-on-write (COW) mechanism and why it prevents write modifications from altering base system templates.
Mount a dynamic OverlayFS via the command-line interface, demonstrating file creations and modifications.

Module 6: Capstone: Assembling the Go Container Runtime

In this capstone module, you will synthesize everything you have learned. You will combine namespaces, chroot execution jails, cgroup limits, and overlay mounts inside a single compilable Go application.

Step-by-Step Runtime Design Pattern

To build your custom container runtime in Go, structure your program around a re-execution model:

[Parent CLI Execution (run)] │ ▼ (Spawns a duplicate child process with namespace flags enabled) [Child Process Setup (child)] │ ├─► Pin executing thread using LockOSThread() ├─► Apply control limits inside /sys/fs/cgroup ├─► Mount merged OverlayFS layer ├─► Run syscall.Chroot() and PivotRoot to isolation rootfs ├─► Mount virtual filesystems (/proc) │ ▼ (Executes targeted executable command inside jail) [Target Application Execution]

Re-execution Orchestration: You cannot safely apply namespaces directly to a running multi-threaded Go process. Instead, have your initial execution (run) spawn a copy of itself (/proc/self/exe) passing a hidden argument (child).
Clone Configuration: Configure the spawned process with isolation options inside the SysProcAttr attributes struct, using namespace flags like CLONE_NEWUTS, CLONE_NEWPID, and CLONE_NEWNS.
Sandbox Configuration: Within the isolated child execution block:
- Mount your pre-assembled OverlayFS directories.
- Lock execution paths to a local virtual root path using syscall.Chroot().
- Register the child PID (os.Getpid()) inside your customized /sys/fs/cgroup limits.
- Replace the child shell execution thread using syscall.Exec().

Knowledge Checkpoint

Code a complete multi-phase re-execution workflow (/proc/self/exe) in Go.
Safely mount /proc inside the containerized process jail, ensuring running processes are displayed correctly.
Test and run your custom container binary, confirming hostname, PID, and memory isolation.

Course Map

Key People Index

Liz Rice
Chief Open Source Officer at Isovalent and former CNCF Governing Board Chair. Her "Containers from Scratch" talks helped demystify low-level systems programming concepts for application developers worldwide.
Michael Kerrisk
Author of The Linux Programming Interface and long-time maintainer of the Linux man-pages project. He is a leading authority on namespace and cgroup implementations.
Solomon Hykes
Co-founder of Docker. His early integration of namespaces, chroot, and Union Filesystems into a unified package developer workflow helped popularize modern container standards.

Final Self-Assessment

Explore Further

Related Computer Science Roadmaps

View All→

computer-science

Container Runtimes: Namespaces, Cgroups & Go

Module 1: Linux Systems & Go Programming Foundations

Recommended Videos

Knowledge Checkpoint

Module 2: The Core of Isolation: Chroot and Filesystems

Recommended Videos

Knowledge Checkpoint

Module 3: Linux Namespaces: Process Isolation

Recommended Videos

Knowledge Checkpoint

Module 4: Control Groups (cgroups): Resource Limiting

Recommended Videos

Practical Walkthrough: Managing Cgroups in Go

Knowledge Checkpoint

Module 5: Overlay Filesystems and Image Layers

Recommended Videos

Supplemental Study: Simulating OverlayFS Mounts

Mount the layers

Verify file visibility

Modify a file inside merged layer

Verify Copy-On-Write (COW) behavior:

The base layer remains unchanged, while changes are captured in the upper directory.

Knowledge Checkpoint

Module 6: Capstone: Assembling the Go Container Runtime

Recommended Videos

Step-by-Step Runtime Design Pattern

Knowledge Checkpoint

Course Map

Key People Index

Final Self-Assessment

Related Computer Science Roadmaps

Building a CHIP-8 Emulator: Rust & CPU Basics

Building BitTorrent: Go, P2P & Concurrency

Actor Models (C++ Concurrency & Lock-Free)

Coding HM Type Inference: Algorithm W & OCaml