aki Junichiro Literary Award (2003). She has been a member of the PEN Centre Germany since 2016.
There is no better way to learn something than by building it. So let's understand and build a container from scratch.
Nowadays, almost everything is using containers, and at SumUp, it isn't different. Since we use it a lot, I want to improve my understanding of containers and how it works behind the scenes, and this is why we are going to build a container from scratch.
The old containers were not more than a mix of Linux Namespaces and Cgroups. Modern containers like Docker and Podman have reached a complex state with more than that. We'll keep ourselves in the namespaces field in this post and slowly explore more possibilities in future posts.
We have namespaces, which isolate the Linux kernel global system resources like mounting points or network devices. We also have Cgroups, which limit resource usages like memory and CPU. One guarantees isolation, while the other guarantees the container won't make the host machine starve.
We have a few types of namespaces, each wrapping specific global system resources in an abstraction. For example, the PID Namespace isolates the process ID number space. It allows every container to have its own init process, and it is the first step to creating containers that won't be able to see the host's processes.
The second step involves calling the mount syscall, which is something we will be doing in subsequent posts. Unsharing the PID Namespace won't be enough.
Processes created during the booting are within the root namespaces, and their children spawned by a fork or clone syscall will inherit them. The only way to not inherit them is if you ask to unshare the namespaces. We can do it by passing specific flags to the clone syscall or by calling the unshare syscall.
The code above is simple, even though it's written using C. The first part prepares and calls the clone syscall, and then the parent process waits for the child while it prints its PID. It's important to note that the child process does not share the same PID Namespace with its parent.
The output of the above code is interesting because it shows the child process has PID 1, and it's different from the host's PID 1.
Child with PID 1 here!
Running these commands requires being a superuser, and we could avoid this by using User Namespaces. But this is a discussion for later when we talk about rootless containers.
We can create nested namespaces, and every namespace must have a parent but for the root namespaces. So, for example, the PID namespace we created above for the child's process has the root as its parent, but if it calls the clone syscall again, the parent won't be the root anymore.
We could add more namespaces kinds by changing the clone syscall. Another essential one for containers is the Mount Namespace, which isolates mounting points seen from within the namespace. We will create chroot jails soon, and Mount Namespaces will be essential for this task.
Note: if you want a detailed explanation of namespaces, I recommend Michael Kerrisk's series.
We want to execute different commands inside our container, so we must modify our code to spawn a shell that we can control.
I modified the child's function to execute the file given in the command line. I also changed the clone syscall parameters to unshare the Mount Namespace and pass the arguments to the child function.
We can now get a shell inside our isolated environment, and we could even run other commands, as shown above.
Isolating mounting points and the PID number space was great, but it's time to go further because we didn't unshare the Mount Namespace in vain. It was the first step to isolating which processes the container can see and confining its filesystem.
GraphQL: Multiple GraphQL Endpoint.&gt;I think the potential to be closest of all these men's matches is Monfils-Anderson. It could go to 5 sets.
  
Anything and everything is possible with Monfils. Monfils has owned Kevin in their previous five meetings but they've never played on grass. I feel as though if Monfils plays the way he did against Querrey he'll win and relatively easily. But expecting Monfils to sustain quality mental error free tennis isn't exactly a quality proposition either. 
   
I actually think Simon-Del Potro is the most likely to go to five but Raonic-McDonald could be a tight one as well.AD Mark Hollis and deputy AD Greg Ianni
Roughing the passer?
You be the judge.
Penn State's Marcus Allen was flagged for roughing Michigan State quarterback Brian Lewerke with 49 seconds left in Saturday's Big Ten showdown at Spartan Stadium.
The third-down play likely would have given Penn State the ball after Lewerke's pass fell incomplete. Instead, the Spartans' drive was extended, and Matt Coghlin connected on a 34-yard field goal as time expired to cap a 27-24 upset of Penn State.
Here's a sampling of the reaction on social media:
Bang-bang play
Here's the roughing the passer penalty on Penn State's Marcus Allen pic.twitter.com/navEmNEn0g— Dr. Saturday (@YahooDrSaturday) November 4, 2017
#Spartans Lewerke on roughing the passer “luckily the guy kinda hit me low”— FOX 2 Sports (@FOX2Sports) November 4, 2017
White drops it...BUT ROUGHING THE PASSER!!! Free 15. Lewerke got smoked. #Spartans— Jay Scott Smith (@JayScottSmith) November 4, 2017
Looks like textbook roughing the passer to me. Lunged for Lewerke's knees well after the ball was released.— David Henry (@imau2fan) November 4, 2017
And no, "but this is football" isn't an adequate argument.
Of course, it all led to Coghlin's game-winner:
More Spartans:
Michigan State-Penn State takeaways: Spartans back in Big Ten title hunt
Michigan State stuns Penn State with last-second field goal, 27-24
Felton was feeling it
Michigan State wide receiver Felton Davis set the tone early, then turned in one of his best performances of his career: 12 catches for 181 yards and a stunning diving touchdown in the first half.
Felton Davis' 8th TD grab of the year was a thing of beauty. @TheFreak84_#MSUvsPSU tied up at 14. pic.twitter.com/A7oUJXXHxO— Jay Sarkar (@WLNSJaySarkar) November 4, 2017
There goes my guy Felton Davis with a diving TD! Whew pic.twitter.com/4hSpFtxBFj— Billy Marshall (@BillyM_91) November 4, 2017
Michigan State is first to score coming out of the long delay. pic.twitter.com/UcCynAN5Kr— The Daily Collegian (@DailyCollegian) November 4, 2017
How did Davis do it?
Felton Davis: "It's see ball, get ball. That's what we say in our room."— Matt Charboneau (@mattcharboneau) November 5, 2017
Dantonio drops a stat: "I think we had 12 receptions coming back... Felton Davis had 12 today."— Souichi D. Terada (@SouichiTerada26) November 4, 2017
Game highlights
The Big Ten Network compiled highlights of the game. Check them out!
It took like seven hours, thanks to the weather.— Big Ten Network (@BigTenNetwork) November 4, 2017
But No. 24 @MSU_Football's win vs. No. 7 Penn State was a thriller. pic.twitter.com/rf2OqPnOiI
Next up, Buckeyes
Michigan State's Big Ten title hopes looked bleak after the Spartans lost to Northwestern last week. But after Ohio State's stunning loss to Iowa on Saturday, MSU has a chance to take control in the Big Ten Eastern Division next week in Columbus.
Saquon Barkley, Penn State's Heisman Trophy-caliber running back, noticed as much during the game:
Frey said Barkley told him Ohio State was losing as he was covering him during the game. "He said, 'Yo, we're playing for a championship.'"— Chris Solari (@chrissolari) November 4, 2017
Dantonio vs. Urban. Ohio State vs. Michigan State with the Big Ten division title on the line. Just the way it's supposed to be in November.— Romando (@RomandoDixson) November 4, 2017
So, it's Michigan State-Ohio State next week for the Big Ten East, or...?— Nick Baumgardner (@nickbaumgardner) November 4, 2017
Just like you drew it up?
% chance to win B1G, per @FiveThirtyEight:— Patrick Andres (@PAndres2001) November 5, 2017
Wisconsin 49
Ohio State 45
Michigan State 4
Penn State/Michigan/field 2
Rain is a good thing?
It's fair to wonder how the weather affected Penn State, which led 14-7 before the nearly 3 1/2-hour delay for severe weather.
What we do know, thanks to social media, is how the Spartans handled it:
Felton Davis says on the postgame