Docker is weird

Running Docker containers requires root privileges on Linux, which has security implications and limits its use in certain environments.

A developer building a custom container runtime has revealed several surprising technical details about Docker's inner workings. Contrary to common perception, containers are not a distinct entity but rather isolated Linux processes utilizing kernel features like namespaces and cgroups for resource restriction and network isolation. Container images are essentially compressed folders, and Docker uses chroot or pivot_root to establish them as a container's root directory. The article also highlights challenges with Go, the language used for Docker's runtime component `runc`, particularly its multi-threading and lack of a direct `fork` system call, necessitating complex workarounds. Furthermore, it points out that Docker traditionally requires root privileges for its daemon, though rootless alternatives are emerging with complex user-space networking implementations.

The revelation that Docker images are merely folders and containers are restricted processes challenges the abstraction users often rely on, suggesting a deeper understanding of Linux kernel features is necessary for advanced container management. This complexity in the underlying technology means that core functionalities like networking or process isolation might involve intricate user-space reimplementations, especially in rootless environments.

The limitations of Go as a language for container runtimes, as exemplified by `runc`, indicate a potential area for future innovation or alternative tooling that might offer more streamlined or efficient solutions for low-level system operations. Developers building container infrastructure may need to consider these language-specific trade-offs when selecting or developing runtime components.