Partitioning and isolating: namespaces and cgroups
What Linux namespaces hide, what control groups limit, the role of chroot and capabilities, and the out-of-memory killer: understanding what a container really is and reading an exit at 137.
- 32 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- The numbers
- Scenarios
A few cards from the deck
Namespace: what is it?
Show the answer
A Linux kernel mechanism that gives a group of processes its own view of a global resource (processes, network, mount points, host name, users, inter-process communication).
It bounds what a process sees, not what it consumes. Containers combine seven of them: pid, net, mnt, uts, ipc, user and cgroup; Linux added time in 2020.
Two containers on the same machine each listen on port 80 of their own network, without publishing a port. Why does neither report that the port is taken?
- Each has its own network namespace, so its own ports
- Docker renumbers the port of one of them when it starts
- A network control group gives each its own port range
- The kernel lets containers of the same image share a port
Show the answer
Each has its own network namespace, so its own ports
Interfaces, routes and ports belong to the net namespace. Two distinct namespaces, two independent port tables. There is no network control group: groups cap quantities.
In a container, the first process has number …: the … namespace gives it its own numbering.
Show the answer
In a container, the first process has number 1: the pid namespace gives it its own numbering.
docker run --rm alpine sh -c 'echo $$'prints1. On the host, the same process has another number, which only the host sees.Control group (cgroup): what is it?
Show the answer
A Linux kernel mechanism that groups processes to measure and cap what they consume: CPU, memory, number of processes, disk throughput.
It bounds what a process consumes, not what it sees. A container combines both: namespaces for the view, control groups for the quantities.