Welcome to Containers 101: A sysadmin’s guide to containers

What you need to know to understand how containers work.

The term "containers" is heavily overused. Also, depending on the context, it can mean different things to different people.

Traditional Linux containers are really just ordinary processes on a Linux system. These groups of processes are isolated from other groups of processes using resource constraints (control groups [cgroups]), Linux security constraints (Unix permissions, capabilities, SELinux, AppArmor, seccomp, etc.), and namespaces (PID, network, mount, etc.).

If you boot a modern Linux system and took a look at any process with cat /proc/PID/cgroup, you see that the process is in a cgroup. If you look at /proc/PID/status, you see capabilities. If you look at /proc/self/attr/current, you see SELinux labels. If you look at /proc/PID/ns, you see the list of namespaces the process is in. So, if you define a container as a process with resource constraints, Linux security constraints, and namespaces, by definition every process on a Linux system is in a container. This is why we often say Linux is containers, containers are Linux. Container runtimes are tools that modify these resource constraints, security, and namespaces and launch the container.

WHAT TO READ THIS WEEK

• 3 steps to start running containers today
  In this tutorial, you will learn how to run two containers in a pod to host a WordPress site.
  
  
• How I build my personal website using containers with a Makefile
  Simplify container management by combining the commands to build, test, and deploy a project in a Makefile.
  
  
• Free online course: Deploying containerized applications
  Containers, Kubernetes and Red Hat OpenShift Technical Overview (DO080) is a series of on-demand, online videos that introduces you to Linux® containers and container orchestration technology using Docker, Kubernetes, and Red Hat® OpenShift Container Platform.