Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Chroot vs Docker

I'm trying to learn the basics about containers (Docker in this case). As far as I learn from the Docker doc and several readings, Docker basically provides isolation by running the container using runc (previously using LXC). Either ways it uses the same kernel as the host machine. Thus, the container image needs to be compatible with the host kernel. I find this very similar to what a chroot does. Could somebody explain to me any differences and/or advantages on using Docker rather than chroot? (besides the extras provided by Docker as packaging, docker-hub, and all the nice features provided by Docker)

like image 541
rkachach Avatar asked Sep 27 '17 14:09

rkachach


People also ask

Is Docker similar to chroot?

It's an open source project and provides the same basic functionality the Docker engine does but without root privileges. It works by creating a chroot -like environment over the extracted container and uses various implementation strategies to mimic chroot execution with just user-level privileges.

What is chroot container?

It's a Linux command that allows you to set the root directory of a new process. In our container use case, we just set the root directory to be where-ever the new container's new root directory should be.

What does chroot do in Linux?

A chroot (short for change root) is a Unix operation that changes the apparent root directory to the one specified by the user. Any process you run after a chroot operation only has access to the newly defined root directory and its subdirectories.


1 Answers

Docker allows to isolate a process at multiple levels through namespaces:

  • mnt namespace provides a root filesystem (this one can be compared to chroot I guess)
  • pid namespace so the process only sees itself and its children
  • network namespace which allows the container to have its dedicated network stack
  • user namespace (quite new) which allows a non root user on a host to be mapped with the root user within the container
  • uts provides dedicated hostname
  • ipc provides dedicated shared memory

All of this adds more isolation than chroot provides

like image 59
Luc Avatar answered Sep 22 '22 08:09

Luc