{
    "archive_path": "archive/1792750005.575328",
    "base_url": "codeandcake.dev/posts/2026-10-22-docker-is-weird",
    "basename": "2026-10-22-docker-is-weird",
    "bookmarked_date": "2026-10-23 10:06",
    "canonical": {
        "archive_org_path": "https://web.archive.org/web/codeandcake.dev/posts/2026-10-22-docker-is-weird",
        "dom_path": "output.html",
        "favicon_path": "favicon.ico",
        "git_path": "git/",
        "google_favicon_path": "https://www.google.com/s2/favicons?domain=codeandcake.dev",
        "headers_path": "headers.json",
        "htmltotext_path": "htmltotext.txt",
        "index_path": "index.html",
        "media_path": "media/",
        "mercury_path": "mercury/content.html",
        "pdf_path": "output.pdf",
        "readability_path": "readability/content.html",
        "screenshot_path": "screenshot.png",
        "singlefile_path": "singlefile.html",
        "warc_path": "warc/",
        "wget_path": "codeandcake.dev/posts/2026-10-22-docker-is-weird.html"
    },
    "domain": "codeandcake.dev",
    "extension": "",
    "hash": "1CG0GGDVRQZ7RR7WN20Q",
    "history": {
        "archive_org": [],
        "dom": [],
        "favicon": [
            {
                "cmd": [
                    "curl",
                    "--silent",
                    "--location",
                    "--compressed",
                    "--max-time",
                    "120",
                    "--output",
                    "favicon.ico",
                    "--user-agent",
                    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) curl/curl 8.14.1 (x86_64-pc-linux-gnu)",
                    "https://www.google.com/s2/favicons?domain=codeandcake.dev"
                ],
                "cmd_version": "curl 8.14.1 (x86_64-pc-linux-gnu)",
                "end_ts": "2026-10-23T10:09:42.960757+00:00",
                "index_texts": null,
                "output": "favicon.ico",
                "pwd": "/data/archive/1792750005.575328",
                "schema": "ArchiveResult",
                "start_ts": "2026-10-23T10:09:42.416570+00:00",
                "status": "succeeded"
            }
        ],
        "git": [],
        "headers": [
            {
                "cmd": [
                    "curl",
                    "--silent",
                    "--location",
                    "--compressed",
                    "--head",
                    "--max-time",
                    "120",
                    "--user-agent",
                    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) curl/curl 8.14.1 (x86_64-pc-linux-gnu)",
                    "https://codeandcake.dev/posts/2026-10-22-docker-is-weird"
                ],
                "cmd_version": "curl 8.14.1 (x86_64-pc-linux-gnu)",
                "end_ts": "2026-10-23T10:09:43.389354+00:00",
                "index_texts": null,
                "output": "headers.json",
                "pwd": "/data/archive/1792750005.575328",
                "schema": "ArchiveResult",
                "start_ts": "2026-10-23T10:09:42.972694+00:00",
                "status": "succeeded"
            }
        ],
        "htmltotext": [],
        "media": [],
        "mercury": [
            {
                "cmd": [
                    "/app/node_modules/@postlight/parser/cli.js",
                    "https://codeandcake.dev/posts/2026-10-22-docker-is-weird"
                ],
                "cmd_version": "1.0.0",
                "end_ts": "2026-10-23T10:09:48.772314+00:00",
                "index_texts": null,
                "output": "mercury",
                "pwd": "/data/archive/1792750005.575328",
                "schema": "ArchiveResult",
                "start_ts": "2026-10-23T10:09:45.817870+00:00",
                "status": "succeeded"
            }
        ],
        "pdf": [],
        "readability": [
            {
                "cmd": [
                    "/app/node_modules/readability-extractor/readability-extractor",
                    "/tmp/tmph3eg6ih9",
                    "https://codeandcake.dev/posts/2026-10-22-docker-is-weird"
                ],
                "cmd_version": "0.0.11",
                "end_ts": "2026-10-23T10:09:45.804877+00:00",
                "index_texts": [
                    "I decided to make my own container runtime for fun, and even though I\u2019m still early on, I\u2019ve learned that Docker is weird. Here\u2019s some weird things I learned about Docker.\n\nContainers aren\u2019t real\n\nUnlike VMs, containers are just processes with special restrictions on them. Your kernel is still running that process! And if you know where to look, you can even find that process in /proc.\n\nContainers really aren\u2019t real\n\nThere\u2019s not really a linux feature that\u2019s just \u201ccontainers\u201d either. Instead, containers are really 5 different linux kernel features in trenchcoat.\n\nNamespaces hide what the host and container can see, cgroups limit container resource usage, and there\u2019s a whole bunch of networking magic I don\u2019t understand that lets you isolate a container\u2019s network.\n\nImages are just folders\n\nImages are just folders that Docker puts somewhere and then calls chroot (or pivot_root) to make that folder your container process\u2019s new root directory. So if you run docker run -it --rm ubuntu /bin/bash, Docker is going to:\n\n  Download the ubuntu image from Dockerhub.\n  Put that image somewhere.\n  Run /some/weird/docker/path/bin/bash\n\n\nGo is kind of a terrible language for a container runtime\n\nDocker\u2019s container runtime, runc, is written in Go, and Go has some design choices that make it less suited for a container runtime. Go\u2019s runtime is natively multi-threaded. That\u2019s a really cool feature, but it leads to some challenges in runc.\n\nMany of the Linux syscalls a container runtime needs to make have to be done in a single-threaded environment, so runc has a crazy C module that runs before Go\u2019s runtime initializes so it can run those syscalls.\n\nGo also doesn\u2019t have fork! Fork only forks the main thread, so it\u2019s kind of a footgun in a runtime like Go\u2019s. But a container runtime really wants to fork, set up a bunch of restrictions, and then exec the process you actually put in docker run. To get around this, runc execs /proc/self/exe with a special command line arguement that identifies it as a child process to approximate a fork.\n\nDocker requires root!\n\nThis is pretty easy to miss if you, like me, run Docker in MacOS. Many of the Linux kernel APIs that container runtimes use require, or at least used to, to be run as root, so the Docker daemon usually runs as root. I can only imagine that container security is a very tough job.\n\nThis seems better these days. The big exception seems to be networking. If you\u2019re running a rootless container runtime, it looks like it has to reimplement the whole networking stack in userspace to actually give you the same features!\n\nLearning is fun!\n\nI\u2019ve only just started my own container runtime, and I already feel like I\u2019ve learned so much about Docker. Writing your own version of a tool you use is a great way to learn about it!"
                ],
                "output": "readability",
                "pwd": "/data/archive/1792750005.575328",
                "schema": "ArchiveResult",
                "start_ts": "2026-10-23T10:09:44.042363+00:00",
                "status": "succeeded"
            }
        ],
        "screenshot": [],
        "singlefile": [],
        "title": [
            {
                "cmd": [
                    "curl",
                    "--silent",
                    "--location",
                    "--compressed",
                    "--max-time",
                    "120",
                    "--user-agent",
                    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) curl/curl 8.14.1 (x86_64-pc-linux-gnu)",
                    "https://codeandcake.dev/posts/2026-10-22-docker-is-weird"
                ],
                "cmd_version": "curl 8.14.1 (x86_64-pc-linux-gnu)",
                "end_ts": "2026-10-23T10:09:44.033368+00:00",
                "index_texts": null,
                "output": "Code and Cake - Docker is weird",
                "pwd": "/data/archive/1792750005.575328",
                "schema": "ArchiveResult",
                "start_ts": "2026-10-23T10:09:44.022170+00:00",
                "status": "succeeded"
            }
        ],
        "wget": [
            {
                "cmd": [
                    "wget",
                    "--no-verbose",
                    "--adjust-extension",
                    "--convert-links",
                    "--force-directories",
                    "--span-hosts",
                    "--no-parent",
                    "-e",
                    "robots=off",
                    "--reject=js,mjs,woff,woff2,ttf,otf,eot,mp4,m4v,mov,webm,ogv,mkv,avi,flv",
                    "--timeout=120",
                    "--restrict-file-names=windows",
                    "--page-requisites",
                    "--user-agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) wget/GNU Wget 1.21.3",
                    "--compression=auto",
                    "--timestamping",
                    "https://codeandcake.dev/posts/2026-10-22-docker-is-weird"
                ],
                "cmd_version": "GNU Wget 1.21.3",
                "end_ts": "2026-10-23T10:09:44.013698+00:00",
                "index_texts": null,
                "output": "codeandcake.dev/posts/2026-10-22-docker-is-weird.html",
                "pwd": "/data/archive/1792750005.575328",
                "schema": "ArchiveResult",
                "start_ts": "2026-10-23T10:09:43.399534+00:00",
                "status": "succeeded"
            }
        ]
    },
    "icons": null,
    "is_archived": true,
    "is_static": false,
    "latest": {
        "archive_org": null,
        "dom": null,
        "favicon": "favicon.ico",
        "git": null,
        "media": null,
        "pdf": null,
        "screenshot": null,
        "singlefile": null,
        "title": "Code and Cake - Docker is weird",
        "warc": null,
        "wget": "codeandcake.dev/posts/2026-10-22-docker-is-weird.html"
    },
    "link_dir": "/data/archive/1792750005.575328",
    "newest_archive_date": "2026-10-23T10:09:45.817870+00:00",
    "num_failures": 0,
    "num_outputs": 6,
    "oldest_archive_date": "2026-10-23T10:09:42.416570+00:00",
    "path": "/posts/2026-10-22-docker-is-weird",
    "schema": "Link",
    "scheme": "https",
    "snapshot_id": "e5339d49-0273-431e-9154-b68eab07006f",
    "sources": [
        "/data/sources/1792750005-import.txt"
    ],
    "tags": null,
    "tags_str": "",
    "timestamp": "1792750005.575328",
    "title": "Code and Cake - Docker is weird",
    "updated": "2026-10-23T10:09:42.414481+00:00",
    "updated_date": "2026-10-23 10:09",
    "url": "https://codeandcake.dev/posts/2026-10-22-docker-is-weird"
}