Developer Learns Container Internals the Hard Way by Building One From Scratch

A developer who had recently passed a Docker exam decided to build a container from scratch using Linux primitives, quickly discovering that knowing container terminology is very different from implementing the underlying mechanics. Experimenting with the unshare command, they found that PID namespaces only apply to child processes, meaning the --fork flag is required for a process to actually appear as PID 1. They also learned that tools like ps read from /proc rather than querying the kernel directly, so remounting the proc filesystem inside the namespace was necessary for isolation to be visible. Further experiments with UTS namespaces demonstrated how hostname isolation works at the kernel level, producing different hostname views on the same machine. The exercise highlighted how hands-on implementation exposes gaps in conceptual understanding that passing exams or memorizing terminology cannot reveal.