A Different Root Directory, and Why It Is Not a Wall
Last timeA Different View of the System
Replacing the root of the file system for one process changes where path lookup begins and nothing else, which is why the image carries a whole distribution and why the file you wrote is gone.
A container started from a small web service image lists six or seven entries
in its root directory and not one of them is the machine's own. Meanwhile the
machine's own root directory has not moved, and the process doing the listing
is an ordinary process that the host can see in its own process list. Both of
those are true at the same instant, on one kernel, with no second operating
system anywhere.
This is the feature most explanations reach for first, and it is almost always
described as the wall around the container. It is not a wall. It is a change to
where exactly one operation begins. Everything that follows, including why the
image weighs 180 MB and where the file you wrote inside the container went,
falls out of that one change and out of the way the image is stacked underneath
it.
What actually changes
Every process on the machine carries a field naming the directory that counts
as its root. The kernel reads that field in one place only, which is the
resolution of a path. A path that begins with a slash begins at the process's
root; a path that does not begins at the process's working directory. Replace
the field and the same seventeen characters, /etc/resolv.conf, name a different
file from the one they named a moment earlier.
Two consequences come straight off that sentence. The change is free, because it
is a write to one field rather than a copy of anything, which is why a container
starts in about 80 milliseconds while a virtual machine takes about 25 seconds.
And the change is inherited, because a new process gets its parent's root, which
is why every process the container starts is in the same world without anybody
arranging it.
A container runtime does not stop at swapping the field. The old call for this,
chroot, changes where lookup starts and leaves the machine's real root mounted
and merely unnameable. What a runtime actually uses, pivot_root, moves the old
root out of the way so that it can then be unmounted, which means the host's
file system is not just unreachable by name but is no longer in this process's
mount table at all. That second step is the one most explanations skip, and
skipping it is why the two calls are so often described as the same operation.
The mount table is itself per process state, which is what makes any of this
possible: this process's list of mounts can be rewritten without rewriting
anybody else's.
Why the image has to carry a distribution
Nothing about the kernel changed. Every system call the process could make
before the swap it can still make afterwards, with the same arguments and the
same effects, because the system call table is one table in one kernel and no
part of this touched it. What changed is that every file the process could open
has gone, and a dynamically linked program is held together by files.
The program needs its interpreter and its C library, by absolute path. Turning
a name into an address needs a configuration file and a resolver library.
Verifying a certificate needs a directory of certificates. A program that shells
out needs a shell. Reading the local time needs a time zone database. None of
that is in the kernel, all of it is in the distribution, and the distribution is
files.
So the image carries user space, and that is the whole of what an image is.
The lesson stops here
8 more paragraphs to go
You have read the opening. The rest of the argument, the problems that check whether it landed, and the lines worth keeping at the end all come with a plan.
The first lesson of every course in the library reads the whole way through, free, so you can see exactly what the rest of them are.
See the planThe contentsThis is the reading half
Starting the course gives you your own copy of it. Every idea on every page has problems standing under it, marked with a reason rather than a tick, and any sentence you do not believe can be opened and argued with. None of that can happen on a page nobody owns.
The contents