> Markdown version of [/videos/1094-docker-exec-without-docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Docker exec without Docker

Ever wondered what happens if you strip away the Docker CLI? Learn to replicate docker exec using raw Linux primitives to master resource isolation and tighten security.

- **Speakers:** [Oliver Seitz](https://www.wearedevelopers.com/@oliver-seitz)
- **Event:** World Congress 2024
- **Published:** August 20, 2024
- **Duration:** 29:16
- **URL:** https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker

## Summary

Docker famously simplified containerization, but beneath the accessible CLI, containers are essentially just standard Linux processes governed by core kernel features. This presentation demystifies the magic of container runtimes by demonstrating how to replicate the functionality of `docker exec` entirely without Docker, offering developers a deeper look into the underlying architecture. By inspecting this bottom layer, teams can learn to isolate and constrain application resources using raw Linux primitives. The foundation of containerization relies on two main mechanisms: cgroups (Control Groups) for resource limitation and namespaces for environment isolation. Through command-line demonstrations using tools like `unshare` and `nsenter`, the discussion illustrates how to restrict CPU utilization, bind processes to memory limits, and isolate file systems or local loopback network interfaces. Notably, the PID cgroup can be manually configured to restrict the maximum number of processes spawned in a runtime. This effectively mitigates certain remote code execution vulnerabilities by appropriately blocking unauthorized auxiliary processes, like reverse shells, from starting inside the container. While standard container runtimes automate this heavy lifting, understanding the kernel level empowers developers to build better security architectures, such as grasping the precise mechanics behind mapping user IDs to avoid running as a host-level root. The ultimate takeaway for modern engineers is to look beyond the abstraction layer of daily developer tools—diving into documentation and Linux man pages—to build a more rigorous, secure comprehension of underlying software deployment operations.

**Keywords:** docker architecture internals, linux control groups, linux namespaces, container isolation mechanics, application process limitation, pid cgroup security, network namespace configuration, mount namespace isolation, nsenter command usage, unshare command execution, remote code execution mitigation, container environment emulation, kernel level resource management, host user id mapping, uts namespace hostnames

## Chapters

1. **Demystifying the mechanics behind container execution routines** (00:00) — Exploring the underlying execution paths and hidden processes activated when launching standard container commands.
1. **Essential Linux kernel features for running containers** (03:16) — How operating system features like control groups and namespaces form the foundational building blocks of containerization.
1. **Limiting container resources using control groups** (04:58) — Configuring processing time, memory thresholds, process creation counts, and io constraints to prevent system resource exhaustion.
1. **Controlling process execution limits directly via shell** (07:55) — Manually assigning running processes to a modified cgroup filesystem configuration to observe utilization throttling.
1. **Isolating container environments with Linux namespaces** (11:30) — Utilizing network interfaces, mount points, process trees, and user identity mapping to sandbox application boundaries.
1. **Creating isolated network interfaces via the unshare command** (17:16) — Spawning partitioned local network spaces to selectively restrict the inter-process communication pathways.
1. **Joining an active process environment using nsenter** (20:45) — Using process identifiers to dynamically attach standard host shells into previously localized target namespaces.
1. **Simulating the docker exec command with native tools** (23:53) — Entering a running web server container strictly by targeting its root process identifiers through nsenter execution.
1. **Learning strategies for deep technical tool understanding** (27:32) — Why investigating low-level implementations and limiting operational scope yields better security insights over superficial usage.

## Related Moments

- [Fundamentals of container network isolation and system components](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) (from "Docker network without Docker")
- [Isolating workloads using kernel namespaces and control groups](https://www.wearedevelopers.com/videos/412-kubernetes-security-challenge-and-opportunity) (from "Kubernetes Security - Challenge and Opportunity")
- [Handling container constraints and fileless malware](https://www.wearedevelopers.com/videos/356-enhancing-workload-security-in-kubernetes) (from "Enhancing Workload Security in Kubernetes")
- [Orchestrating with Kubernetes against Docker and accessing slides](https://www.wearedevelopers.com/videos/487-debug-a-kubernetes-operator) (from "Debug a Kubernetes Operator")
- [Answering audience questions on container functionality and local workflows](https://www.wearedevelopers.com/videos/166-local-development-techniques-with-kubernetes) (from "Local Development Techniques with Kubernetes")
- [Enterprise container migration and historical technology evolution](https://www.wearedevelopers.com/videos/410-containers-in-the-cloud-state-of-the-art-in-2022) (from "Containers in the cloud - State of the Art in 2022")

## Related Articles

- [Building AI Solutions with Rust and Docker](https://www.wearedevelopers.com/magazine/494-building-ai-solutions-with-rust-and-docker)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [How we Build The Software of Tomorrow](https://www.wearedevelopers.com/magazine/120-how-we-build-the-software-of-tomorrow)

## Related Jobs

- [IT System Administrator](https://www.wearedevelopers.com/jobs/48290-it-system-administrator) at **Sensory-Minds GmbH**
- [Platform Engineer (DevOps)](https://www.wearedevelopers.com/jobs/48264-platform-engineer-devops) at **WDW Consulting GmbH**
- [Devops Engineer](https://www.wearedevelopers.com/jobs/ext/1940926-devops-engineer) at **Bitpanda**
- [Developer Embedded Linux](https://www.wearedevelopers.com/jobs/ext/381560-developer-embedded-linux) at **ZEISS Group**
- [Developer Embedded Linux](https://www.wearedevelopers.com/jobs/ext/1543045-developer-embedded-linux) at **ZEISS Group**
- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**