priya00300/iza-container

Purpose and Entry Point

Iza is a privileged, single-binary Linux container runtime. It manages image root filesystems and launches isolated processes using kernel primitives rather than a daemon or OCI engine. The executable entry point and likely implementation boundary are in main.cpp; Makefile builds the iza binary.

Command Dispatcher

The CLI exposes image operations (pull, images), execution (run), and lifecycle operations (ps, stop, rm). run accepts resource limits, environment variables, hostname overrides, volume mappings, an image reference, and an optional command. Command parsing and orchestration are centralized in main.cpp.

Image Acquisition and Local Image Store

Image management downloads minimal Alpine or Ubuntu rootfs archives from remote HTTP sources, then unpacks them into a local image cache. This stage depends on libcurl for retrieval and libarchive for archive extraction. Images are expected beneath /var/lib/iza/images/<image>/rootfs, including manually imported rootfs trees. Implementation: main.cpp.

Container Filesystem Construction

For each run, the runtime creates container-specific writable workspace and combines it with an image rootfs using OverlayFS. The resulting merged filesystem becomes the process root via chroot or pivot_root; a recursive-copy fallback supports environments where OverlayFS cannot mount. Host volumes cross the isolation boundary as bind mounts into this new mount namespace. Implementation: main.cpp.

Isolated Process Launch

The runtime creates the container child with raw Linux clone, isolating process, mount, network, UTS/hostname, and IPC namespaces. In the child, it prepares the root filesystem, applies hostname and environment settings, mounts requested volumes, then executes the requested command through execvp. This is Linux-only and requires root privileges. Implementation: main.cpp.

Resource Enforcement

Before or during launch, a cgroups v2 manager creates/configures a cgroup under /sys/fs/cgroup/ and assigns the container process to it. CLI memory and CPU options translate into kernel-enforced limits. The host must expose cgroups v2 controllers; this is a hard infrastructure dependency. Implementation: main.cpp.

Lifecycle State and Cleanup

The runtime persists container IDs, image references, commands, host PIDs, and status in JSON files under /var/lib/iza/state/. ps reads this metadata, stop resolves an ID or prefix and terminates the tracked process, and rm removes state plus OverlayFS mounts and workspace trees. JSON persistence uses jsoncpp. Implementation: main.cpp.