Container Runtime Internals - Namespaces, cgroups v2, seccomp, overlayfs, runc, OCI, and gVisor. #1007490

Container Runtime Internals is a practical engineering guide to the Linux primitives that make containers work: namespaces, cgroups v2, seccomp, capabilities, and overlayfs. It covers the OCI specifications that standardize them, the low-level runtimes that implement them (runc, crun, youki), the middle layer that manages them (containerd, CRI-O), and the sandboxed alternatives that harden them (gVisor, Kata, Firecracker). It covers the failure modes that quietly weaken isolation — extra capabilities that slip through, cgroups that are set but not enforced, namespace configurations that share more than intended, overlay layers that fill the host disk — along with the countermeasures and operational tradeoffs for each.