Cracking Open the Black Box: Building a Linux Container Runtime from Scratch in Rust
You type `docker run` every day, but how does it actually cage a process? Where does namespace fit in, what does cgroup do, and what magic is OverlayFS? Armed with these questions, I built capsule-box from scratch in Rust — a tiny container runtime with a daemon/client architecture, namespace isolation, cgroup v2 memory limits, an OverlayFS filesystem, veth+bridge+NAT networking, and PTY interactive terminals. This post breaks down what each piece does and what the container underbelly really looks like.