Eric Chiang
ericchiang.github.io · Personal blog · on HN since 2015
Eric Chiang writes engineering tutorials on containers, Go, Rust shared libraries, TLS, and the Trusted Platform Module.
What HN saysCommenters repeatedly point to "Containers from Scratch" as a detailed, hands-on walkthrough of how Linux containers work using namespaces and chroot.
16HN people shared it
6linked it in comments
19stories submitted
172story points
2 years agolast shared
2015people per year2026
Most-shared posts
- 1Containers from Scratch13 people · 23 points · first shared 2017 · 4 comments on HN
- 2Intro to TLS with Go2 people · 8 points · first shared 2015 · discussion on HN
- 3Writing Shared Libraries in Rust2 people · 8 points · first shared 2024 · discussion on HN
- 4Calling C from Go2 people · 2 points · first shared 2024 · discussion on HN
- 5Analyzing Spotify Stream History1 people · 123 points · first shared 2024 · 21 comments on HN
- 6Protobuf Generators for Fun and Profit1 people · 2 points · first shared 2025 · discussion on HN
- 7Go Testing With Docker1 people · 2 points · first shared 2015 · discussion on HN
- 8The Trusted Platform Module Key Hierarchy1 people · 2 points · first shared 2022 · discussion on HN
- 9Confidential Compute and GPUs1 people · 1 points · first shared 2025 · discussion on HN
- 10A Primer on User Namespaces1 people · 1 points · first shared 2019 · discussion on HN
What HN people wrote when they linked it
ahepp · 2024-03-27
If this struck your interest, but you want more nitty gritty examples and details, you may find the following article interesting: https://ericchiang.github.io/post/containers-from-scratch/
If I'm remembering correctly from when I ran through the instructions at home, it was written for the original cgroup sysfs interface rather than the more modern cgroup2 [0]. You can figure out which you're running with
> mount | grep cgroup > cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)
which turns the examples is a nice "check your understanding"
[0]: https://docs.kernel.org/admin-guide/cgroup-v2.html#basic-operations
asicsp · 2025-03-27
lloeki · 2023-09-26
> How does this work?
Essentially, like this:
https://ericchiang.github.io/post/containers-from-scratch/
https://earthly.dev/blog/chroot/
> The way Docker Desktop (and podman.io) implement "containers on macOS" is a bit of a cop-out
It's not, it's a requirement for running Linux containers: https://news.ycombinator.com/item?id=37656401
DfM is more like running the CLI locally to a remote Linux machine, and all it does is conveniently expose /Users in the same place through the VM folder share so that you have the convenient illusion that it happens locally.
If Darwin had process namespacing features it would not make it magically able to run Linux processes.
mitnk · 2022-11-09
btdmaster · 2021-05-02
I find plain Linux namespaces as sufficient for many things, for example:
unshare --map-root-user chroot ~/rootfs /bin/sh
Sure, it might not be able to clone the rootfs for you, but you don't need snapd to install it and it comes as part of util-linux, essentially being part of almost all Linux systems. (https://ilearnedhowto.wordpress.com/tag/unshare/ is a nice introduction.)
Edit: https://ericchiang.github.io/post/containers-from-scratch/ is also interesting.
chatmasta · 2017-12-01
Start with namespaces and cgroups. Once you realize that docker is basically a management interface over those, everything will click.
I’m trying to find a really good blog from years ago but having trouble. This looks good though: https://ericchiang.github.io/post/containers-from-scratch/