A design doc for a secure, multi-tenant container orchestrator to run isolated third-party code, focusing on security layers and OS requirements.
Explains the core functions of low-level container runtimes, focusing on Linux namespaces and cgroups for container isolation and resource management.
A technical comparison of container technologies (Linux containers, Solaris Zones, BSD Jails) versus VMs, focusing on design philosophy and flexibility.
Explores the technical challenges and differences between traditional containers and true sandbox environments, focusing on user namespaces and privilege levels.
Explores decompression bombs and demonstrates using Docker's cgroup blkio controls to throttle disk I/O bandwidth.
Explains how to access and gather CPU, memory, I/O, and network usage metrics from Linux control groups (cgroups) for LXC and Docker containers.
