Lion Cipher Lab
Build a container from scratch: namespaces, cgroups, and a root filesystem (there is no such thing as a container)
- Foundations
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Once you run one container, it is tempting to treat it as a magic box that keeps things separate. It is not a box. A container is an ordinary Linux process that the kernel has been told to isolate with two families of primitives — NAMESPACES (which change what a process can SEE: its own hostname, its own process numbers, its own filesystem, its own network) and CGROUPS (which limit what a process can USE: memory, CPU, I/O) — plus a swapped-out root filesystem so it sees a different set of files. This lab has you assemble all of that by hand with `unshare`, `chroot` and a cgroup, until a plain…
What you'll learn
- creating UTS, PID, mount and network namespaces with unshare(1)
- understanding what each namespace type isolates
- swapping the root filesystem with chroot (and why pivot_root is better)
- mounting a private /proc so ps only sees the container's PIDs
- capping memory and CPU with a cgroup v2 controller
- reasoning about container escapes and hardening from first principles
Steps in this lab
- What a container actually is — namespaces + cgroups + a root filesystem
- Confirm you have a real kernel, cgroup v2, and unshare
- Prove the UTS namespace: your own hostname without touching the host's
- Create the full isolation set: UTS + PID + mount + net, with a private /proc
- Get a minimal root filesystem to become the container's `/`
- Swap the root filesystem: chroot into the rootfs (and why pivot_root is better)
- Cap resources with a cgroup v2 controller — make the limit actually bite
- You just built a container — and here is exactly what it is NOT