Build Your Own Container Runtime in Go

We all run containers. Most of us couldn't build one. In this hands-on workshop I strip away the "magic" and we build a minimal container runtime from scratch — in Go, live — using nothing but the Linux kernel primitives that make isolation possible. No Docker, no runc.

We start from a single process and progressively wrap it in the four pillars of containerisation: namespaces (what a container can see), cgroups v2 (what a container can use), capabilities (what a container can do), and a pivoted root filesystem (where a container lives). By the end you'll have a working mycontainer run command that isolates PID, mount, UTS and network namespaces — and you'll understand exactly what docker run has been doing on your behalf all along.

Attendees leave with a mental model of a container as "a process wearing a costume", not a virtual machine, the actual syscalls and /sys interactions behind every container they've ever run, and a complete, commented Go codebase to take home and extend.