Internals — Cheat Sheet
Docker · 1 topics. Download the PDF or the Instagram carousel and share it.
Cheat Sheet · AiCanCode.org
Internals
Docker1 topicsQuick revision reference
1
Docker Internals — Namespaces, cgroups & OverlayFS
Docker containers are not magic — they are Linux processes with namespace isolation, cgroup resource limits, and an OverlayFS layered filesystem. Understanding internals helps you debug, optimise, and reason about security.
- ✓Docker containers are Linux processes with namespace isolation — not VMs.
- ✓PID namespace: container thinks its process is PID 1 (not the host's PID).
- ✓cgroups enforce hard limits on CPU, memory, and processes — exceeding memory limit triggers OOM kill.
- ✓OverlayFS stacks read-only image layers + writable container layer using Copy-on-Write.
- ✓Writing a file in a container copies it from the lower layer to the writable upper layer (doesn't modify the image).
- ✓A "fat" image with many files is slow to start because more data must be read across layers.
bash — inspecting namespaces
# See a container's namespaces from the host
docker run -d --name demo nginx:alpine
PID=$(docker inspect -f '{{.State.Pid}}' demo)
# List namespaces of the container's root process
ls -la /proc/$PID/ns/
# lrwxrwxrwx ... cgroup -> cgroup:[4026531835]
# lrwxrwxrwx ... ipc -> ipc:[4026532350] ↠isolated IPC
# lrwxrwxrwx ... mnt -> mnt:[4026532348] ↠isolated filesystem
# lrwxrwxrwx ... net -> net:[4026532352] ↠isolated network stack
# lrwxrwxrwx ... pid -> pid:[4026532349] ↠isolated PIDs (PID 1 inside)
# lrwxrwxrwx ... uts -> uts:[4026532347] ↠isolated hostname
# lrwxrwxrwx ... user -> user:[4026531837] ↠UID/GID mapping
# Inside container, nginx is PID 1:
docker exec demo ps aux
# PID USER COMMAND
# 1 root nginx: master process
# 31 nginx nginx: worker process
# On host, it is just another PID (e.g., 18423):
ps aux | grep nginxLearn this free with Aria, your AI tutor → AiCanCode.org/learn/docker