A hands-on, ground-up introduction to Linux containers — no magic, just Linux.
Ever repaired a Linux system by booting a live CD and chroot-ing into it? Then you already understand the soul of containerization. This tutorial takes you from that mental model all the way to building, distributing, and securing OCI images.
By the end of this course you will understand, hands-on:
- The anatomy of a Linux container (namespaces, cgroups, chroot)
- How to build a minimal container image from scratch
- How to publish and consume images from a public registry
- Alternative runtimes beyond Docker (systemd-nspawn)
- Security primitives (capabilities, seccomp, syscall tracing)
- How to debug containers at the syscall level
Everything is exercised in a real VM, not just read about.
You need Vagrant and a provider (VirtualBox or UTM/QEMU for Apple Silicon).
git clone <this repo>
cd container101
vagrant up # provisions Debian 13 ARM64 + docker + tools
vagrant sshInside the box:
sudo su - # most chapters assume root
cd /home/vagrant/container101
make # builds the sample helloworld binaryEach chapter is a self-contained lesson: explanation → verified exercise → deeper links.
| # | Chapter | Focus |
|---|---|---|
| 01 | Setup | Prepare the environment |
| 02 | Play with chroot | The first isolation primitive |
| 03 | Control Groups (cgroups) | Freeze, kill, monitor processes |
| 04 | Namespaces | PID, mount, network isolation |
| 05 | Docker Images | Build, run, and manage containers |
| 06 | Container Registries | Push/pull from Docker Hub |
| 07 | systemd-nspawn | The systemd-native runtime |
| 08 | Capabilities & Permissions | Fine-grained privilege control |
| 09 | Syscalls & seccomp | Trace and restrict kernel interface |
The chapters build upward in abstraction, but each is understandable on its own.
graph TD
A[chroot] --> B[namespaces / cgroups]
B --> C[Docker image]
C --> D[Container Registry]
D --> E[systemd-nspawn]
E --> F[Capabilities]
F --> G[seccomp / syscalls]
We start where containers come from (Plan 9 namespaces, chroot), because if you skip this you never truly understand Docker. Then we walk you up the stack to modern primitives.
- Deep intro to container concepts: A Brief History of Containers
- Terminology: A Practical Introduction to Container Terminology
- Hands-on with OCI runtimes: Docker Labs
- The bigger picture: The Missing Introduction To Containerization
- All exercises are designed to be run on a Linux host or VM with Docker. We test on Debian 13 (trixie) ARM64.
- Some examples document different behavior between ARM64 and x86-64 — that's the point; container syscall layers differ per architecture.
- If a command fails in your version of Docker, check the chapter's note on platform differences — many behaviors changed between Docker 1.x and 26+.
- Want to discuss? Open an issue!
MIT — see LICENSE.