3

I'm trying to learn more about the fundamentals of containerization.

I came across the term "OS-Level Virtualization" as the partitioning of the user space to further increase process isolation. However, I have two questions about this

  • what is the benefit of this? aren't processes already fairly isolated via separate virtual address spaces?
  • how is this related to different processes seeing different filesystems? does OS-Level Virtualization enable processes to 'see' different filesystems? If so, how?
Improve this question
1
  • In practice, it might be relevant which other processes can be seen and interacted with, e.g. send a kill signal. In containers, host processes can be made inaccessible. Under Linux, operating system resources are divided into "namespaces" where containers can have an independent copy. Aside from filesystems (mount ns) and processes, there's a networking ns, user ns, and some others. This can be combined with other Linux features, e.g. cgroups for resource limits or seccomp to limit available syscalls. I've written a deep dive about this here. – amon Jan 2 at 23:46
6

aren't processes already fairly isolated via separate virtual address spaces?

A bit isolated, yes, in that one process cannot access the memory of another process. But it can do various other things which will interfere with the proper running of other processes, for example by using up all of one resource (CPU, memory, filesystem handles) or another.

does OS-Level Virtualization enable processes to 'see' different filesystems?

Yes.

If so, how?

Black magic. Or more accurately, depends on which technology you're talking about; Docker on a Linux system uses union filesystems, but other technologies and other OSes will use different approaches.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.