Linux Namespaces & Cgroups: Complete Guide to Container Isolation

#!/bin/bash
# minimal-container.sh - Build a container from scratch using namespaces and cgroups

set -euo pipefail

CONTAINER_NAME="mycontainer"
CONTAINER_ID=$(uuidgen | cut -d- -f1)
CONTAINER_ROOT="/var/containers/$CONTAINER_ID"
CONTAINER_CGROUP="containers/$CONTAINER_ID"

# Container image (busybox)
IMAGE_URL="https://busybox.net/downloads/binaries/1.35.0-x86_64-linux-musl/busybox"
IMAGE_FILE="/tmp/busybox"

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

log() {
    echo -e "${GREEN}[+]${NC} $1"
}

error() {
    echo -e "${RED}[!]${NC} $1" >&2
    exit 1
}

# Download busybox if not present
download_busybox() {
    if [[ ! -f "$IMAGE_FILE" ]]; then
        log "Downloading busybox..."
        curl -s -o "$IMAGE_FILE" "$IMAGE_URL" || error "Failed to download busybox"
        chmod +x "$IMAGE_FILE"
    fi
}

# Setup container root filesystem
setup_rootfs() {
    log "Setting up container root filesystem..."
    
    mkdir -p "$CONTAINER_ROOT"
    mkdir -p "$CONTAINER_ROOT/bin"
    mkdir -p "$CONTAINER_ROOT/etc"
    mkdir -p "$CONTAINER_ROOT/proc"
    mkdir -p "$CONTAINER_ROOT/sys"
    mkdir -p "$CONTAINER_ROOT/tmp"
    mkdir -p "$CONTAINER_ROOT/dev"
    mkdir -p "$CONTAINER_ROOT/home"
    
    # Copy busybox
    cp "$IMAGE_FILE" "$CONTAINER_ROOT/bin/busybox"
    
    # Create symlinks for busybox applets
    "$CONTAINER_ROOT/bin/busybox" --list | while read applet; do
        ln -sf /bin/busybox "$CONTAINER_ROOT/bin/$applet"
    done
    
    # Create minimal /etc files
    cat > "$CONTAINER_ROOT/etc/passwd" << EOF
root:x:0:0:root:/root:/bin/sh
EOF
    
    cat > "$CONTAINER_ROOT/etc/group" << EOF
root:x:0:
EOF
    
    cat > "$CONTAINER_ROOT/etc/hostname" << EOF
$CONTAINER_NAME
EOF
    
    cat > "$CONTAINER_ROOT/etc/hosts" << EOF
127.0.0.1   localhost $CONTAINER_NAME
::1         localhost ip6-localhost ip6-loopback
EOF
    
    # Create container init script
    cat > "$CONTAINER_ROOT/init.sh" << 'EOF'
#!/bin/sh
# Container init script

# Mount proc and sys
mount -t proc proc /proc
mount -t sysfs sysfs /sys
mount -t tmpfs tmpfs /tmp
mount -t devtmpfs devtmpfs /dev

# Set hostname
hostname $(cat /etc/hostname)

# Drop to shell
echo "Container started as PID $$"
exec /bin/sh
EOF
    
    chmod +x "$CONTAINER_ROOT/init.sh"
}

# Create cgroup for container
setup_cgroup() {
    log "Setting up cgroup..."
    
    CGROUP_PATH="/sys/fs/cgroup/$CONTAINER_CGROUP"
    mkdir -p "$CGROUP_PATH"
    
    # Set resource limits
    echo "50000 100000" > "$CGROUP_PATH/cpu.max"      # 50% CPU
    echo "100M" > "$CGROUP_PATH/memory.max"           # 100MB memory
    echo "50M" > "$CGROUP_PATH/memory.swap.max"       # 50MB swap
    echo "100" > "$CGROUP_PATH/pids.max"              # 100 processes max
}

# Start container
start_container() {
    log "Starting container $CONTAINER_NAME..."
    
    # Create network namespace
    ip netns add "$CONTAINER_NAME" 2>/dev/null || true
    
    # Start container process with namespaces
    unshare \
        --pid --fork \
        --mount \
        --uts \
        --ipc \
        --net=/var/run/netns/$CONTAINER_NAME \
        --user --map-root-user \
        --cgroup \
        chroot "$CONTAINER_ROOT" /init.sh &
    
    CONTAINER_PID=$!
    log "Container started with PID: $CONTAINER_PID"
    
    # Add container process to cgroup
    echo "$CONTAINER_PID" > "/sys/fs/cgroup/$CONTAINER_CGROUP/cgroup.procs"
    
    # Setup network in namespace
    setup_network
    
    log "Container is running!"
    log "Attach with: nsenter -t $CONTAINER_PID -a"
}

# Setup container network
setup_network() {
    log "Setting up container network..."
    
    # Create veth pair
    ip link add veth0 type veth peer name veth1
    
    # Move veth1 to container namespace
    ip link set veth1 netns "$CONTAINER_NAME"
    
    # Configure host side
    ip addr add 10.0.0.1/24 dev veth0
    ip link set veth0 up
    
    # Configure container side
    ip netns exec "$CONTAINER_NAME" ip addr add 10.0.0.2/24 dev veth1
    ip netns exec "$CONTAINER_NAME" ip link set veth1 up
    ip netns exec "$CONTAINER_NAME" ip link set lo up
    ip netns exec "$CONTAINER_NAME" ip route add default via 10.0.0.1
    
    # Enable NAT
    iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -j MASQUERADE
    iptables -A FORWARD -i veth0 -j ACCEPT
    iptables -A FORWARD -o veth0 -j ACCEPT
    
    # Enable IP forwarding
    echo 1 > /proc/sys/net/ipv4/ip_forward
}

# Stop container
stop_container() {
    log "Stopping container..."
    
    # Kill container process
    kill -9 "$CONTAINER_PID" 2>/dev/null || true
    
    # Cleanup network
    ip netns del "$CONTAINER_NAME" 2>/dev/null || true
    ip link del veth0 2>/dev/null || true
    
    # Cleanup cgroup
    rmdir "/sys/fs/cgroup/$CONTAINER_CGROUP" 2>/dev/null || true
    
    log "Container stopped"
}

# Cleanup container filesystem
cleanup() {
    log "Cleaning up..."
    rm -rf "$CONTAINER_ROOT"
}

# Main execution
main() {
    download_busybox
    setup_rootfs
    setup_cgroup
    start_container
    
    # Wait for user input
    echo "Press Enter to stop container..."
    read
    
    stop_container
    cleanup
}

# Run main function
main "$@"

#!/bin/bash
# container-manager.sh - Complete container lifecycle management

CONTAINERS_DIR="/var/containers"
CGROUP_ROOT="/sys/fs/cgroup"

list_containers() {
    echo "Running containers:"
    echo "=================="
    
    for pid in $(find /proc -maxdepth 1 -type d -name '[0-9]*'); do
        if [[ -f "$pid/ns/pid" ]]; then
            ns_id=$(readlink "$pid/ns/pid" | cut -d[ -f2 | cut -d] -f1)
            echo "PID: $(basename $pid) | Namespace: $ns_id"
        fi
    done | sort -u
    
    echo ""
    echo "Cgroups:"
    echo "========"
    find "$CGROUP_ROOT" -type d -name "container_*" 2>/dev/null | while read cg; do
        echo "Cgroup: $(basename $cg)"
        [[ -f "$cg/cgroup.procs" ]] && echo "  PIDs: $(cat $cg/cgroup.procs | tr '\n' ' ')"
    done
}

inspect_container() {
    local container_pid="$1"
    
    if [[ ! -d "/proc/$container_pid" ]]; then
        echo "Error: Process $container_pid does not exist"
        return 1
    fi
    
    echo "=== Container Inspection: PID $container_pid ==="
    echo ""
    
    # Namespaces
    echo "Namespaces:"
    ls -la "/proc/$container_pid/ns/" | tail -n +2
    echo ""
    
    # Cgroup
    echo "Cgroup:"
    cat "/proc/$container_pid/cgroup"
    echo ""
    
    # Process tree
    echo "Process Tree:"
    pstree -p "$container_pid"
    echo ""
    
    # Resource usage
    echo "Resource Usage:"
    echo "CPU: $(ps -p $container_pid -o %cpu --no-headers)%"
    echo "Memory: $(ps -p $container_pid -o %mem --no-headers)%"
    echo ""
    
    # Network
    echo "Network Namespace:"
    ip netns identify "$container_pid" 2>/dev/null || echo "Not in network namespace"
}

container_stats() {
    local container_pid="$1"
    local cgroup_path=$(cat "/proc/$container_pid/cgroup" | grep -o "containers/.*" | cut -d: -f2)
    
    if [[ -z "$cgroup_path" ]]; then
        echo "No cgroup found for container"
        return 1
    fi
    
    echo "=== Container Statistics ==="
    echo ""
    
    # CPU
    echo "CPU:"
    cat "/sys/fs/cgroup/$cgroup_path/cpu.stat" 2>/dev/null || echo "N/A"
    echo ""
    
    # Memory
    echo "Memory:"
    echo "Current: $(cat /sys/fs/cgroup/$cgroup_path/memory.current 2>/dev/null || echo 0) bytes"
    echo "Limit: $(cat /sys/fs/cgroup/$cgroup_path/memory.max 2>/dev/null || echo max)"
    echo ""
    
    # IO
    echo "IO:"
    cat "/sys/fs/cgroup/$cgroup_path/io.stat" 2>/dev/null || echo "N/A"
}

# Main menu
case "${1:-list}" in
    "list")
        list_containers
        ;;
    "inspect")
        inspect_container "$2"
        ;;
    "stats")
        container_stats "$2"
        ;;
    "help")
        echo "Usage: $0 [command]"
        echo "Commands:"
        echo "  list                 - List all containers"
        echo "  inspect         - Inspect specific container"
        echo "  stats           - Show container statistics"
        echo "  help                 - Show this help"
        ;;
    *)
        echo "Unknown command: $1"
        echo "Use: $0 help"
        ;;
esac