How fewbytes/rubber-docker works
Rubber Docker is a hands-on workshop for building a Linux container runtime one feature at a time. Learners start with process creation and command execution, then add image-root setup, filesystem and namespace isolation, resource controls, and non-root execution. The level scripts are successive teaching stages rather than modules in one assembled application. The README also identifies the linux.c syscall bindings, preparation material, and workshop slides. Runtime wiring below reflects the sampled scripts; later capabilities are represented as documented lessons.
Main entry points: 10_setuid/rd.py Containment setup · 00_fork_exec/rd.py Fork and exec · 01_chroot_image/rd.py Image and chroot · 02_mount_ns/rd.py Mount namespace
Components 21
Container lessons
- Fork and exec
levels/00_fork_exec/rd.py - Image and chroot
levels/01_chroot_image/rd.py - Mount namespace
levels/02_mount_ns/rd.py - Pivot root
levels/03_pivot_root/rd.py - Overlay filesystem
levels/04_overlay/rd.py - UTS namespace
levels/05_uts_namespace/rd.py - PID namespace
levels/06_pid_namespace/rd.py - Network namespace
levels/07_net_namespace/rd.py - CPU cgroup
levels/08_cpu_cgroup/rd.py - Memory cgroup
levels/09_memory_cgorup/rd.py - Non-root user
levels/10_setuid/rd.py
Runtime implementation
- Container runner
levels/10_setuid/rd.py - Image root setup
levels/10_setuid/rd.py - Containment setup
levels/10_setuid/rd.py - Container command
levels/10_setuid/rd.py
Linux syscall layer
- Syscall bindings
linux.c
Workshop materials
- Preparation guides
docs/prep.md - Workshop slides
slides/workshop.html
Other components
- Workshop learner
- Image tarballs
- Linux host
Connections 21
- Workshop learner → Fork and exec: starts lessons
- Fork and exec → Image and chroot: next lesson
- Image and chroot → Mount namespace: next lesson
- Mount namespace → Pivot root: next lesson
- Pivot root → Overlay filesystem: next lesson
- Overlay filesystem → UTS namespace: next lesson
- UTS namespace → PID namespace: next lesson
- PID namespace → Network namespace: next lesson
- Network namespace → CPU cgroup: next lesson
- CPU cgroup → Memory cgroup: next lesson
- Memory cgroup → Non-root user: next lesson
- Workshop learner → Container runner: runs command
- Container runner → Image root setup: prepares image
- Image tarballs → Image root setup: extracts image
- Container runner → Containment setup: clones child
- Containment setup → Image root setup: mounts root
- Containment setup → Syscall bindings: calls syscalls
- Containment setup → Container command: executes command
- Syscall bindings → Linux host: invokes kernel
- Workshop learner → Preparation guides: reads preparation
- Workshop learner → Workshop slides: follows slides