- [Narrator] One of Docker's jobs is to manage
the processes in containers, keep them isolated
and keep them talking to each other where appropriate.
First, a little primer on processes in Linux.
Processes come from other processes,
it's a parent-child relationship, just one parent though.
When a process exits, it returns
that package to the process that started it.
And there's a special process, Process Zero called init
that's the process that starts it all
and every other process in a Linux system comes
from dividing that process into other processes.
So, in Docker, your container starts
with one process, the init process.
That process can divide into other processes
and do any number of things.
Often it starts with a shell and that shell splits off
and runs commands and runs other processes.
And when that init process exits,
your container just vanishes and the other processes
that were in it at the time that the init process exits,
gets shut down unceremoniously.
The container is done.
Over here, I'm just gonna start up an example container.
Docker run-ti--clean up after yourself.
And I'm gonna give it a name.
- -name is hello and then I'll run Ubuntu
and run Bash within that.
Okay, now that it's running, I want to find out
what is the name of the root process inside this container?
And the convenient way to do that
is with the docker inspect command.
Docker inspect is an incredibly powerful way
to find out any piece of information
about a program programmatically.
It provides this jQuery-like syntax
that you can use to drill down through
the data structure of that container
and extract any information you need.
It's very useful when scripting.
So I'm gonna run docker inspect--format
and say I only want to find out
the process id, Pid, of the main process in this container.
So I'm gonna get .State.Pid and then,
I would like to apply that
to the container with the name hello.
And I get out a process identification number.
Let me just copy that to the clipboard here.
Now I'm gonna start up a super privileged container
with most of the safeties turned off so
that I can use it to kill a process in
the underlying host without being stopped by Docker.
I'm gonna run docker-run with the usual ti
and clean up after yourself.
Now I'm gonna pass privileged=true
to turn off most of the safeties
and pid=host, H-O-S-T,
to turn off even more of the safeties.
Then we'll start with an Ubuntu image
and run it interactive bash.
Okay now that it's running, let's kill that process
and watch what happens to the container over here.
Bang, that container is done.
And a very important job of Docker is to control access
to the limited resources on the machine.
That's the amount of time
the CPU can spend doing things and the amount of memory
that can be allocated between containers.
These limitations are inherited,
and this is very important.
If a container is given a certain amount
of memory and CPU time, no matter how many processes
it starts, the sum total
of all those processes can't exceed the quota
that was given to the initial process.
They can split it up differently amongst themselves,
however they'd like, but you can't escape your limits
by starting more processes in order to consume more limits.