A developer built a working container in 30 lines to demystify how they actually work

A software developer set out to understand what containers truly are at the kernel level, finding that no special kernel object called a 'container' actually exists. Using Linux's unshare command with a handful of namespace flags, they isolated a process with its own hostname, PID table, network stack, and filesystem in roughly 30 lines of code — no Docker required. Each flag, such as --pid, --net, and --uts, requests one specific type of isolation from the kernel, making the mechanism far simpler than most developers assume. The trickier step involved replacing the root filesystem, where pivot_root was used instead of chroot to fully unmount the old root and eliminate any escape path. The exercise demonstrated that container isolation is not a complex built system but a series of direct, incremental requests to the Linux kernel.