- [Instructor] The Docker engine utilizes
something called 'Namespaces' to isolate what's
happening in the running containers from
the operating system that those containers
are running on.
With Namespaces the kernal resources such as
the process ID, user IDs, network storage,
and inner process communications or IPC,
can all be virtualized and shared between the
host operating system and the containers
running on top.
Namespaces weren't created by Docker.
Linux Namespaces are a core feature of the
Linux kernal and have been around since 2002.
Since that time there's been a lot of
enhancement around Namespaces and
Docker has capitalized on those enhancements
in the Docker engine.
Docker utilizes process, mount, IPC,
network, and user Namespaces to
isolate what's happening on the Docker host from
what's happening in the Docker containers.
Thankfully,
Microsoft has even added the equivalent of
Namespace isolation in Windows so that
Docker for Windows could provide
the same functionality.
Namespaces are similar in concept to what a
hypervisor does to provide the virtual resources
like virtual CPU, virtual memory
and virtual storage to a virtual machine.
Namespaces keep containers isolated until Docker
administrators, for example,
allow containers to communicate over the
Docker virtual networks on the same host.
With the Namespace isolation in Docker
operating systems and applications
running in containers feel like
they have their own process trees,
file systems, network connections, and more.
It's even possible in Docker to map a
user account in a container to a user account
in the host operating system.
Here's a simple example of how
Namespace isolation works.
For example,
here I am in an Ubuntu Docker host,
and if I do a ps minus ef you can see there are
roughly a hundred different processes
running on this host.
If I do the ip adder command or ip address
it'll list out the ip addresses.
You can there's roughly some 70 different
network interfaces on this host.
However if I do a docker run minus it and
let's run alpine Linux and go into the shell,
we pull down an alpine Linux image,
we're running that as a container,
and now if I perform the same commands here,
for example ps minus ef,
we have exactly two processes.
So what's happening in this operating system
in the container is isolated off
the process isolation.
Using Namespaces is isolating us off
from what's happening in the Docker host
and vice versa.
Another example here is if I run the
ip adder command,
you can see we have exactly two interfaces,
with two different ip addresses
on those interfaces.
Again,
another example of how Namespaces work
to isolate off network resources
from the Docker host.
So that's how Namespaces work in Docker.