Docker的底层实现所依赖的关键技术

The underlying technology

Docker is written in Go and makes use of several Linux kernel features to deliver the functionality we've seen.

Namespaces

Docker takes advantage of a technology called namespaces to provide the isolated workspace we call the container.  When you run a container, Docker creates a set of namespaces for that container.

This provides a layer of isolation: each aspect of a container runs in its own namespace and does not have access outside it.

Some of the namespaces that Docker uses are:

• The pid namespace: Used for process isolation (PID: Process ID).

• The net namespace: Used for managing network interfaces (NET: Networking).

• The ipc namespace: Used for managing access to IPC resources (IPC: InterProcess Communication).

• The mnt namespace: Used for managing mount-points (MNT: Mount).

• The uts namespace: Used for isolating kernel and version identifiers. (UTS: Unix Timesharing System).

Control groups

Docker also makes use of another technology called cgroups or control groups. A key to running applications in isolation is to have them only use the resources you want. This ensures containers are good multi-tenant citizens on a host. Control groups allow Docker to share available hardware resources to containers and, if required, set up limits and constraints. For example, limiting the memory available to a specific container.

Union file systems

Union file systems, or UnionFS, are file systems that operate by creating layers, making them very lightweight and fast. Docker uses union file systems to provide the building blocks for containers. Docker can make use of several union file system variants including: AUFS, btrfs, vfs, and DeviceMapper.

Container format

Docker combines these components into a wrapper we call a container format. The default container format is called libcontainer. Docker also supports traditional Linux containers using LXC. In the future, Docker may support other container formats, for example, by integrating with BSD Jails or Solaris Zones.

内容来源：https://docs.docker.com/introduction/understanding-docker/

转载于:https://my.oschina.net/yapple/blog/295128