Train your team

VRT-201 · Virtualization & Containers

Namespaces & cgroups from Scratch

Build a container by hand with the primitives, so the abstraction stops being magic.

Practitioner 3 days in person6 half-days online Max 14 in person

Who this course is for

Platform, DevOps and backend engineers who run containers daily but have never built one — and want the namespace and cgroup machinery to stop being magic so misconfigurations and 'it works on my host' bugs become diagnosable.

Prerequisites

Solid Linux command lineAbility to read C (the runtime you build is small)Basic networking concepts (interfaces, bridges)

Course outline

Day 1 — Namespaces

  • Every namespace type and what each isolates: mnt, uts, ipc, pid, net, user, cgroup, time
  • clone flags vs unshare vs setns — three doors into the same room
  • /proc/pid/ns, namespace file descriptors and lifetime rules
  • User namespaces and UID/GID mapping in detail
  • What namespaces do not isolate, and why that matters

Day 2 — cgroups v2

  • The unified hierarchy and its structural rules
  • Controllers that matter: cpu, memory, io, pids
  • Delegation and the no-internal-process constraint
  • Reading cgroup.stat and memory.events: throttling made visible
  • PSI as a pressure signal and cgroup v1 vs v2 differences that bite

Day 3 — Build a container

  • Assembling a rootfs: what actually needs to be in it
  • pivot_root, mount propagation and cleaning up the host view
  • A minimal container runtime in C, step by step
  • Networking the container: veth pairs and a bridge
  • What real runtimes add on top of what you built

Hands-on labs

Labs follow the academy model — 35% principles, 20% guided investigation, 45% engineering studio. Every claim you make in a lab is backed by a trace, a counter or a measurement you captured yourself. How we teach

  1. Lab: isolate a process step by step with unshare — mount, PID, network, user — verifying each boundary from /proc on both sides
  2. Lab: constrain a workload with cgroup v2 (cpu.max, memory.max, io weight) and watch the throttling appear in cgroup.stat and PSI
  3. Lab: build a minimal container in C: clone with namespaces, pivot_root into a rootfs, exec a shell
  4. Lab: wire two hand-built containers together over a veth pair and bridge, then pass traffic between them
  5. Lab: break your container's isolation deliberately — a shared namespace, a leaked host mount — and observe exactly what becomes reachable

Capstone project

Build a working container runtime in C across the three days: namespace creation, cgroup limits applied before exec, a pivot_root into a minimal rootfs, and veth networking. The deliverable is the runtime source, a demonstration of resource limits visibly throttling a load you generate, and a written isolation audit listing what your runtime does and does not isolate — the document that tells you what runc is actually doing for you.

What you leave with

  • First-hand knowledge of every namespace type, gained by creating each one
  • A hand-written container runtime you built and understand completely
  • Working cgroup v2 skills: limits, delegation and reading throttling evidence
  • A clear map of what containers do not isolate
  • The debugging instinct to inspect /proc/pid/ns and cgroup state before guessing

How it runs

Every course follows the same model: 35% principles, 20% guided investigation, 45% engineering studio. You leave with working code, raw measurements and an evidence-based report — not a certificate of attendance. Read the methodology or see a full sample lesson.

Material is adapted to your kernel version, hardware and workload before a private delivery. For public cohorts, the environment is provided and configured.

Questions

Who is this course for?

Platform, DevOps and backend engineers who run containers daily but have never built one — and want the namespace and cgroup machinery to stop being magic so misconfigurations and 'it works on my host' bugs become diagnosable. It sits at practitioner level within the Virtualization & Containers track.

What do I need to know already?

Specific prerequisites for this course: Solid Linux command line; Ability to read C (the runtime you build is small); Basic networking concepts (interfaces, bridges). We confirm levels before the cohort starts and adapt if a group is stronger or weaker than expected.

Can this run privately for my team?

Yes. Any course runs on-site at your offices anywhere, or live online for a distributed team, with labs adapted to your hardware and codebase.

What is the difference between in-person and online?

In person is 3 full days with hardware on your desk, capped at 14. Online is 6 half-day sessions across about two weeks so you can keep working, capped at 20, with remote lab access.

Do you invoice companies?

Yes. Purchase orders are accepted and invoicing is available in USD, EUR, GBP, SAR and CAD.

Upcoming dates

DatesWhereSeatsEarly birdRegular
8 Nov – 10 Nov 20263 full days RiyadhIn person · KAFD Conference Centre 9 of 14 SAR 7,090until 9 OctSAR 7,880
8 Nov – 10 Nov 20263 full days Kuwait CityIn person · Al Hamra Tower 4 of 14 KWD 580until 9 OctKWD 650
15 Nov – 17 Nov 20263 full days MuscatIn person · Knowledge Oasis Muscat 9 of 14 OMR 730until 16 OctOMR 810
22 Nov – 29 Nov 20266 half-days Gulf bandLive online · 09:00–13:00 GMT+3 17 of 20 US$1,350until 23 OctUS$1,500
23 Nov – 25 Nov 20263 full days OttawaIn person · Kanata North Tech Park 4 of 14 CAD 2,570until 24 OctCAD 2,860
23 Nov – 25 Nov 20263 full days TorontoIn person · MaRS Discovery District 9 of 14 CAD 2,570until 24 OctCAD 2,860
23 Nov – 30 Nov 20266 half-days Europe bandLive online · 09:00–13:00 CET 6 of 20 US$1,350until 24 OctUS$1,500
30 Nov – 2 Dec 20263 full days LondonIn person · Shoreditch Works 4 of 14 GBP 1,480until 31 OctGBP 1,640
30 Nov – 7 Dec 20266 half-days Americas bandLive online · 13:00–17:00 ET 11 of 20 US$1,350until 31 OctUS$1,500
7 Dec – 9 Dec 20263 full days BerlinIn person · Factory Görlitzer Park 9 of 14 EUR 1,740until 7 NovEUR 1,930

Dates shown for the next few months. If nothing fits, tell us where and when — cohorts are added on demand, and private delivery can be scheduled any week.

More in Virtualization & Containers

VRT-1014 days KVM Internals How Linux becomes a hypervisor: vCPU execution, memory virtualisation and the QEMU relationship. Advanced Practitioner-taught SAR 12,000Next 18 Oct VRT-1103 days VFIO & Device Passthrough Giving a guest direct access to real hardware — the mechanism behind GPU passthrough. Advanced Practitioner-taught SAR 9,000Next 15 Nov VRT-1203 days virtio Device Drivers The paravirtualised device model: virtqueues, transports and writing a virtio driver. Advanced Practitioner-taught SAR 9,000Next 1 Nov VRT-2103 days Container Runtimes & the OCI Spec What runc, containerd and the OCI specifications actually define, and how images become running processes. Practitioner Practitioner-taught SAR 7,880Next 18 Oct VRT-2203 days Container Security & seccomp Making containers a real security boundary rather than an organisational one. Advanced Practitioner-taught SAR 9,000Next 22 Nov