A container runtime exposes the Linux mechanisms behind Docker
Building a small container runtime led Code and Cake’s author to examine how Docker combines ordinary Linux processes with namespaces, resource controls and filesystem isolation. One useful detail is runc’s C bootstrap, which performs namespace setup before returning to the Go runtime. The article is an introductory learning account. Its root-privilege discussion needs qualification: Docker also documents a supported rootless mode.
Code and Cake · Oct 22, 2026
Why it matters
A container is a combination of isolation controls, so debugging it benefits from understanding those controls individually.
More context
Read this alongside runc’s namespace bootstrap and Docker’s rootless documentation. Rootless Docker places both the daemon and containers inside a user namespace; it requires UID-mapping tools and subordinate UID/GID ranges on the host.
Keep in mind
The article simplifies image storage and runtime setup. Its criticism of Go is the author’s interpretation, and a changed root directory alone is not a complete security boundary.
Original read