VRT-201 · Virtualization & Containers · Practitioner
Namespaces & cgroups from Scratch — full syllabus
Build a container by hand with the primitives, so the abstraction stops being magic.
Who this course is for
Platform, DevOps and backend engineers who run containers daily but have never built one — and want the namespace and cgroup machinery to stop being magic so misconfigurations and 'it works on my host' bugs become diagnosable.
Prerequisites
- Solid Linux command line
- Ability to read C (the runtime you build is small)
- Basic networking concepts (interfaces, bridges)
Course outline
Day 1 — Namespaces
- Every namespace type and what each isolates: mnt, uts, ipc, pid, net, user, cgroup, time
- clone flags vs unshare vs setns — three doors into the same room
- /proc/pid/ns, namespace file descriptors and lifetime rules
- User namespaces and UID/GID mapping in detail
- What namespaces do not isolate, and why that matters
Day 2 — cgroups v2
- The unified hierarchy and its structural rules
- Controllers that matter: cpu, memory, io, pids
- Delegation and the no-internal-process constraint
- Reading cgroup.stat and memory.events: throttling made visible
- PSI as a pressure signal and cgroup v1 vs v2 differences that bite
Day 3 — Build a container
- Assembling a rootfs: what actually needs to be in it
- pivot_root, mount propagation and cleaning up the host view
- A minimal container runtime in C, step by step
- Networking the container: veth pairs and a bridge
- What real runtimes add on top of what you built
Hands-on labs
- Lab: isolate a process step by step with unshare — mount, PID, network, user — verifying each boundary from /proc on both sides
- Lab: constrain a workload with cgroup v2 (cpu.max, memory.max, io weight) and watch the throttling appear in cgroup.stat and PSI
- Lab: build a minimal container in C: clone with namespaces, pivot_root into a rootfs, exec a shell
- Lab: wire two hand-built containers together over a veth pair and bridge, then pass traffic between them
- Lab: break your container's isolation deliberately — a shared namespace, a leaked host mount — and observe exactly what becomes reachable
Capstone project
Build a working container runtime in C across the three days: namespace creation, cgroup limits applied before exec, a pivot_root into a minimal rootfs, and veth networking. The deliverable is the runtime source, a demonstration of resource limits visibly throttling a load you generate, and a written isolation audit listing what your runtime does and does not isolate — the document that tells you what runc is actually doing for you.
What you leave with
- First-hand knowledge of every namespace type, gained by creating each one
- A hand-written container runtime you built and understand completely
- Working cgroup v2 skills: limits, delegation and reading throttling evidence
- A clear map of what containers do not isolate
- The debugging instinct to inspect /proc/pid/ns and cgroup state before guessing
Upcoming dates
| Dates | Where | Seats | Early bird | Regular | |
|---|---|---|---|---|---|
| 8 Nov – 10 Nov 20263 full days | RiyadhIn person · KAFD Conference Centre | 9 of 14 | SAR 7,090until 9 Oct | ||
| 8 Nov – 10 Nov 20263 full days | Kuwait CityIn person · Al Hamra Tower | 4 of 14 | KWD 580until 9 Oct | ||
| 15 Nov – 17 Nov 20263 full days | MuscatIn person · Knowledge Oasis Muscat | 9 of 14 | OMR 730until 16 Oct | ||
| 22 Nov – 29 Nov 20266 half-days | Gulf bandLive online · 09:00–13:00 GMT+3 | 17 of 20 | US$1,350until 23 Oct | ||
| 23 Nov – 25 Nov 20263 full days | OttawaIn person · Kanata North Tech Park | 4 of 14 | CAD 2,570until 24 Oct | ||
| 23 Nov – 25 Nov 20263 full days | TorontoIn person · MaRS Discovery District | 9 of 14 | CAD 2,570until 24 Oct | ||
| 23 Nov – 30 Nov 20266 half-days | Europe bandLive online · 09:00–13:00 CET | 6 of 20 | US$1,350until 24 Oct | ||
| 30 Nov – 2 Dec 20263 full days | LondonIn person · Shoreditch Works | 4 of 14 | GBP 1,480until 31 Oct | ||
| 30 Nov – 7 Dec 20266 half-days | Americas bandLive online · 13:00–17:00 ET | 11 of 20 | US$1,350until 31 Oct | ||
| 7 Dec – 9 Dec 20263 full days | BerlinIn person · Factory Görlitzer Park | 9 of 14 | EUR 1,740until 7 Nov |
Book a seat, or bring this course to your team
Seats can be reserved online; private delivery runs on-site or live online, adapted to your stack.
Questions about fit or prerequisites? Email hello@kernelsystems.academy. To save this syllabus, print this page to PDF from your browser.