Shipping Your Machine: Building a Container in 50 Lines of Code (Part 2)

Welcome Back to the Jailhouse

In Part 1 of this series, we built the foundation of our container using Go. We successfully used the CLONE_NEWUTS namespace and process forking to isolate our container's hostname from the host machine.

But we still have a massive security flaw. Right now, if we drop into our container's bash shell, we can still see all of the host's files. We could easily cd straight out of our "isolated" environment and mess with the host machine.

Let's lock it down.

chroot to Jail