Docker isolates a process using Linux namespaces, cgroups, and a chrooted filesystem, not a separate virtual machine.
DOCKER'S WEIRDNESS EXPOSED: CONTAINERS ARE JUST PROCESSES
*Docker’s inner mechanics defy the hype. Containers run as ordinary processes, images are mere folders, and the Go‑based runtime forces kludgy workarounds. The security implications are stark.*
On October 22, 2026, a developer posted a candid breakdown of Docker’s architecture on Code and Cake, labeling the platform “weird.” The piece strips away the marketing veneer to expose how Docker builds isolation on top of ordinary Linux processes. Understanding these mechanics matters because the security model hinges on root privileges and a runtime written in a language ill‑suited for low‑level system work.
The post enumerates three surprising facts: containers are merely processes with namespace and cgroup constraints; images are just folders that Docker chroots into; and the Go‑based runtime relies on C shims and exec tricks to compensate for language limitations. These revelations challenge the perception of containers as self‑contained sandboxes and raise questions about the robustness of Docker’s security posture.
What makes a Docker container different from a VM?
Docker containers are not virtual machines. They are ordinary Linux processes constrained by a set of kernel features. Namespaces hide host resources, cgroups limit CPU and memory, and networking tricks isolate traffic. The kernel still runs the container’s main process, which can be inspected in /proc like any other task. No single Linux primitive is called “container”; the isolation is a composite of five kernel mechanisms dressed in a trench coat. This means a container shares the host kernel and cannot provide the hardware‑level separation that VMs do.
Why does Docker need root access?
Docker’s daemon typically runs as root because many of the Linux kernel APIs it calls require elevated privileges. The daemon performs actions such as mounting filesystems, configuring network namespaces, and setting cgroup limits, all of which historically demanded root. When a user runs Docker on macOS, the root requirement is easy to overlook, but on Linux the daemon’s privileged status is essential. Rootless runtimes exist, but they must re‑implement the entire networking stack in userspace to match the features offered by the privileged daemon, highlighting how entrenched root is in Docker’s design.
How does Go complicate Docker’s runtime?
Docker’s low‑level runtime, runc, is written in Go. Go’s runtime is natively multi‑threaded, yet many Linux syscalls needed for container setup must be issued from a single‑threaded context. To bridge this gap, runc ships a C module that runs before Go’s runtime initializes, handling those syscalls. Go also lacks a true fork primitive; its fork only duplicates the main thread, which is unsafe for a container runtime that must fork, apply restrictions, then exec the target process. runc works around this by re‑executing /proc/self/exe with a special flag, mimicking a fork. These workarounds illustrate why Go is considered a poor fit for the low‑level demands of container orchestration.
What does building a custom runtime reveal?
The author of the source post began a personal container runtime project to demystify Docker. In doing so, they discovered that Docker images are simply directories stored on disk. When Docker runs a command like `docker run -it --rm ubuntu /bin/bash`, it downloads the Ubuntu image from Docker Hub, places the directory somewhere on the host, and then uses chroot or pivot_root to make that directory the new root for the process. The exercise reinforced that containers are just processes with a new filesystem view, and that the complexities of Docker stem from stitching together existing kernel features rather than inventing a new abstraction.
Frequently asked questions
What are Docker containers under the hood?
Containers are ordinary Linux processes with special restrictions; the kernel still runs them and they can be found in /proc.
Why does Docker require root privileges?
Many Linux kernel APIs used by Docker need root, so the Docker daemon typically runs as root; rootless runtimes must re‑implement networking in userspace.
What language is Docker's runtime runc written in and why is it problematic?
Runc is written in Go; Go's multi‑threaded runtime and lack of a true fork require a C module and exec tricks to perform necessary syscalls.
The takeaway is clear: Docker’s elegance is a veneer over a patchwork of kernel features, a Go runtime that bends around its own constraints, and a privileged daemon that still demands root. As developers experiment with rootless alternatives or craft their own runtimes, the community will likely push for tighter abstractions that eliminate these legacy compromises. Until then, the “weirdness” of Docker remains a hidden risk in every deployment.
Sources: Hacker News – Docker is weird (https://codeandcake.dev/posts/2026-10-22-docker-is-weird)