Session abstract
What you’ll learn
Every time you run a container on Kubernetes, ECS, or your laptop, something has to create it. But what actually happens between "docker run" and your process running in isolation? In this talk, we'll build a minimal container runtime in Go using the same Linux primitives that power Docker and containerd: namespaces for isolation, cgroups for resource limits, and chroot for filesystem separation. Line by line, we'll construct a working container from nothing but Go and syscalls. You'll walk away understanding what a container actually is at the OS level, why Go is uniquely well-suited for systems tooling like this, and how the infrastructure you deploy to every day really works under the hood. No container experience required.