Build Your Own Docker

Target Audience: Senior Engineers (5+ years experience)
Language: Java (with Go & JavaScript alternatives)
Duration: 4-6 weeks
Difficulty: ⭐⭐⭐⭐⭐

Why Build Docker?

Containers are the foundation of modern infrastructure. Every major company runs containers. By building your own Docker:

Master Linux internals — namespaces, cgroups, capabilities
Understand container security — isolation mechanisms, seccomp, AppArmor
Learn filesystem concepts — overlay filesystems, copy-on-write
Network programming — virtual networking, iptables, bridge networking
Demonstrate staff-level expertise — this is the “wow factor” project

This is the most challenging project in the course. You’ll need:

Linux experience (kernel concepts, syscalls)
Systems programming knowledge
Understanding of networking fundamentals
Familiarity with Docker as a user

Container Architecture Deep Dive

┌─────────────────────────────────────────────────────────────────────────────┐
│                        CONTAINER RUNTIME ARCHITECTURE                        │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│   USER SPACE                    KERNEL SPACE                                │
│   ──────────                    ────────────                                │
│                                                                              │
│   ┌───────────────┐             ┌────────────────────────────────────────┐ │
│   │  CLI (docker) │             │              LINUX KERNEL               │ │
│   └───────┬───────┘             │                                        │ │
│           │                     │  ┌─────────────┐  ┌─────────────────┐  │ │
│   ┌───────▼───────┐             │  │ NAMESPACES  │  │     CGROUPS     │  │ │
│   │   Daemon      │◄───────────►│  │ ─────────── │  │ ───────────────  │  │ │
│   │ (containerd)  │             │  │ • PID       │  │ • cpu           │  │ │
│   └───────┬───────┘             │  │ • NET       │  │ • memory        │  │ │
│           │                     │  │ • MNT       │  │ • blkio         │  │ │
│   ┌───────▼───────┐             │  │ • UTS       │  │ • pids          │  │ │
│   │   Runtime     │             │  │ • USER      │  │                 │  │ │
│   │    (runc)     │             │  │ • IPC       │  │                 │  │ │
│   └───────┬───────┘             │  └─────────────┘  └─────────────────┘  │ │
│           │                     │                                        │ │
│   ┌───────▼───────┐             │  ┌─────────────────────────────────┐  │ │
│   │   Container   │◄───────────►│  │         OVERLAY FS              │  │ │
│   │   Process     │             │  │  ┌─────┐  ┌─────┐  ┌─────┐      │  │ │
│   └───────────────┘             │  │  │Upper│  │Layer│  │Base │      │  │ │
│                                 │  │  │     │◄─│  2  │◄─│Image│      │  │ │
│                                 │  │  └─────┘  └─────┘  └─────┘      │  │ │
│                                 │  └─────────────────────────────────┘  │ │
│                                 └────────────────────────────────────────┘ │
│                                                                              │
└─────────────────────────────────────────────────────────────────────────────┘

What You’ll Build

Core Features

Feature	Description	Linux Concept
PID Namespace	Process isolation	`CLONE_NEWPID`
Mount Namespace	Filesystem isolation	`CLONE_NEWNS`
Network Namespace	Network isolation	`CLONE_NEWNET`
UTS Namespace	Hostname isolation	`CLONE_NEWUTS`
User Namespace	User/group isolation	`CLONE_NEWUSER`
Cgroups	Resource limits	`/sys/fs/cgroup`
Overlay FS	Layered filesystem	`mount -t overlay`
Container Networking	Bridge, veth pairs	`ip link`, `iptables`
Image Format	OCI image spec	Layers, manifests

Interview Deep-Dive

What actually happens under the hood when Docker creates a container? Walk me through the kernel-level operations.

Strong Answer:

The container runtime (runc) makes a sequence of syscalls. First, it calls clone() or unshare() with namespace flags — CLONE_NEWPID, CLONE_NEWNS, CLONE_NEWNET, CLONE_NEWUTS, CLONE_NEWIPC, and optionally CLONE_NEWUSER. Each flag creates a new namespace that gives the child process an isolated view of that particular resource. The process now sees itself as PID 1, has its own hostname, its own mount table, and its own network stack.
Next, the runtime sets up cgroups by writing to files under /sys/fs/cgroup. For example, writing 50000 100000 to cpu.max gives the container 50% of one CPU core. Writing a byte count to memory.max sets the hard memory limit. The container’s PID is written to cgroup.procs to place it under these limits.
The filesystem is assembled using OverlayFS. The runtime mounts an overlay with the image layers as read-only lower directories, an empty upper directory for writes, and a work directory for atomic operations. Then it calls pivot_root() to atomically swap the container’s root filesystem, which is more secure than chroot() because it fully detaches the old root.
For networking, the runtime creates a veth pair — two virtual interfaces connected like a pipe. One end goes into the container’s network namespace (becomes eth0), the other stays in the host namespace and attaches to a bridge (like docker0). NAT rules via iptables MASQUERADE enable outbound connectivity, and DNAT rules handle port forwarding.
Finally, the runtime calls execve() to replace itself with the container’s entrypoint process. At this point, the container is running.

Follow-up: You mentioned pivot_root is more secure than chroot. Why exactly?chroot() only changes the apparent root directory for pathname lookups, but the process retains references to the old root via open file descriptors and the .. trick (if it has root privileges, it can chroot(".") then chdir("..") repeatedly to escape). pivot_root() is an atomic operation that moves the old root to a subdirectory of the new root, and the runtime immediately unmounts and removes that directory. After pivot_root, there is no accessible path back to the host filesystem. This is why every serious container runtime uses pivot_root rather than chroot — the attack surface is meaningfully smaller. In fact, container escape CVEs have historically exploited situations where this was not done correctly, such as CVE-2019-5736 in runc where a malicious container could overwrite the host runc binary.

Containers are often described as 'lightweight virtual machines.' Why is that description misleading, and what are the real security implications?

Strong Answer:

The description is misleading because VMs provide hardware-level isolation through a hypervisor, while containers share the host kernel. A VM has its own kernel, its own device drivers, and communicates with hardware through a hypervisor that mediates all access. A container is just a process with restricted views of the host kernel’s resources.
The security implication is that containers share attack surface with the host kernel. A kernel exploit inside a container can potentially escape to the host because the container is running on the same kernel. With a VM, a kernel exploit only compromises the guest kernel — the hypervisor is a separate, much smaller attack surface.
Real-world example: the Dirty COW vulnerability (CVE-2016-5195) was a Linux kernel race condition that allowed privilege escalation. Inside a VM, this only affected the guest. Inside a container, it could be used to escape to the host because the container shared the vulnerable kernel.
That said, containers have significantly improved their security posture over time. Seccomp profiles restrict which syscalls a container can make (Docker’s default profile blocks ~44 syscalls). AppArmor and SELinux provide mandatory access control. User namespaces map container root to an unprivileged host user. These layers together provide defense in depth, but they are fundamentally different from the hardware isolation boundary of a hypervisor.
The practical takeaway is that containers are appropriate for workload isolation within a trust boundary (your own microservices), but not for running mutually untrusted code (that is what gVisor and Kata Containers address, by adding a kernel-level boundary back into the picture).

Follow-up: How do Kubernetes and cloud providers deal with this shared-kernel risk in multi-tenant environments?Most major cloud providers (AWS EKS Fargate, GCP GKE Autopilot) run each customer’s pods inside a lightweight VM — essentially combining the container developer experience with VM-level isolation. AWS Firecracker is a microVM that boots in ~125ms and provides a KVM-based isolation boundary around each container. Google’s gVisor takes a different approach: it implements a user-space kernel (Sentry) that intercepts syscalls from the container, so the container never talks directly to the host kernel. The trade-off is performance — gVisor adds syscall overhead, Firecracker adds boot time and memory overhead. In practice, this means that the “containers vs. VMs” framing is outdated; modern infrastructure uses both, layered together, with the choice depending on the threat model.

Explain the noisy neighbor problem in containerized environments and how cgroups address it. What can still go wrong?

Strong Answer:

The noisy neighbor problem occurs when one container on a shared host consumes disproportionate resources, degrading performance for other containers. Without limits, a single container running a fork bomb or a memory leak can starve every other workload on the machine.
Cgroups address this by enforcing hard limits on CPU, memory, I/O bandwidth, and process count. The cpu.max file controls bandwidth allocation (e.g., 50000/100000 means 50% of one core). memory.max sets a hard ceiling — if a process exceeds it, the kernel’s OOM killer terminates it. pids.max prevents fork bombs by capping the number of processes.
What can still go wrong: cgroups do not limit everything. Kernel resources that are not cgroup-aware remain shared. For example, the dentry cache (filesystem metadata) and inode cache are global kernel structures. A container doing millions of file operations can bloat these caches and cause memory pressure for the entire host. Similarly, cgroups v1 did not limit kernel memory by default, so a container could exhaust kernel stack pages.
Another subtle issue is CPU throttling. CFS (Completely Fair Scheduler) bandwidth control with cpu.max can cause latency spikes even when the container is well below its quota. If a container uses its entire quota in the first 5ms of a 100ms period, it gets throttled for the remaining 95ms. This is why latency-sensitive applications (like API servers) sometimes see p99 latency spikes that correlate with cgroup throttling periods, not with actual load.
In production, I would also set memory.high (the soft limit that triggers throttling before the hard kill) and use CPU pinning (cpuset.cpus) for latency-critical workloads to avoid cache line bouncing across cores.

Follow-up: How would you debug a situation where a container is being OOM-killed but the application’s memory usage looks normal in your monitoring?This is a classic gotcha. Application-level metrics (like Go’s runtime.MemStats or JVM heap usage) only show user-space allocations. The kernel counts all memory charged to the cgroup, including page cache, tmpfs mounts, kernel stack pages, and slab allocations. A container writing heavily to an in-container tmpfs (like /dev/shm) will consume memory that shows up in memory.current but not in application metrics. The debugging steps: check memory.stat in the cgroup directory (it breaks down RSS, cache, kernel stack, etc.), compare memory.current against memory.max, and look at memory.events for oom_kill counters. Also check if the container is doing heavy filesystem I/O to overlay-mounted paths, because those pages get charged to the cgroup’s page cache.

Implementation: Java

Java might seem unusual for container runtime development, but it demonstrates that containers aren’t magic and can be implemented in any language with proper syscall access. We’ll use JNI (Java Native Interface) to access Linux syscalls.

Project Structure

mydocker/
├── src/main/java/com/mydocker/
│   ├── MyDocker.java
│   ├── cli/
│   │   ├── CLI.java
│   │   ├── RunCommand.java
│   │   ├── PsCommand.java
│   │   └── ImagesCommand.java
│   ├── container/
│   │   ├── Container.java
│   │   ├── ContainerConfig.java
│   │   └── ContainerState.java
│   ├── runtime/
│   │   ├── Runtime.java
│   │   ├── Namespace.java
│   │   ├── Cgroup.java
│   │   └── Filesystem.java
│   ├── network/
│   │   ├── Network.java
│   │   ├── Bridge.java
│   │   └── VethPair.java
│   ├── image/
│   │   ├── Image.java
│   │   ├── Layer.java
│   │   └── Registry.java
│   └── native/
│       └── LinuxSyscalls.java
├── src/main/c/
│   └── syscalls.c
├── pom.xml
└── README.md

Core Implementation

package com.mydocker.container;

import java.nio.file.Path;
import java.util.List;
import java.util.Map;
import java.util.UUID;

/**
 * Represents a container instance
 */
public class Container {
    private final String id;
    private final String name;
    private final ContainerConfig config;
    private ContainerState state;
    private int pid;
    private Path rootfs;
    
    public Container(ContainerConfig config) {
        this.id = UUID.randomUUID().toString().substring(0, 12);
        this.name = config.getName() != null ? config.getName() : "container_" + id.substring(0, 6);
        this.config = config;
        this.state = ContainerState.CREATED;
    }
    
    public String getId() { return id; }
    public String getName() { return name; }
    public ContainerConfig getConfig() { return config; }
    public ContainerState getState() { return state; }
    public int getPid() { return pid; }
    public Path getRootfs() { return rootfs; }
    
    public void setState(ContainerState state) { this.state = state; }
    public void setPid(int pid) { this.pid = pid; }
    public void setRootfs(Path rootfs) { this.rootfs = rootfs; }
}

/**
 * Container configuration
 */
class ContainerConfig {
    private String image;
    private String name;
    private List<String> command;
    private Map<String, String> env;
    private String hostname;
    private boolean tty;
    private boolean interactive;
    private ResourceLimits resources;
    private NetworkConfig network;
    private List<String> volumes;
    
    // Builder pattern for configuration
    public static class Builder {
        private ContainerConfig config = new ContainerConfig();
        
        public Builder image(String image) { config.image = image; return this; }
        public Builder name(String name) { config.name = name; return this; }
        public Builder command(List<String> cmd) { config.command = cmd; return this; }
        public Builder env(Map<String, String> env) { config.env = env; return this; }
        public Builder hostname(String hostname) { config.hostname = hostname; return this; }
        public Builder tty(boolean tty) { config.tty = tty; return this; }
        public Builder interactive(boolean i) { config.interactive = i; return this; }
        public Builder resources(ResourceLimits r) { config.resources = r; return this; }
        public Builder network(NetworkConfig n) { config.network = n; return this; }
        public Builder volumes(List<String> v) { config.volumes = v; return this; }
        
        public ContainerConfig build() { return config; }
    }
    
    public String getImage() { return image; }
    public String getName() { return name; }
    public List<String> getCommand() { return command; }
    public Map<String, String> getEnv() { return env; }
    public String getHostname() { return hostname; }
    public boolean isTty() { return tty; }
    public boolean isInteractive() { return interactive; }
    public ResourceLimits getResources() { return resources; }
    public NetworkConfig getNetwork() { return network; }
    public List<String> getVolumes() { return volumes; }
}

/**
 * Resource limits using cgroups
 */
class ResourceLimits {
    private long memoryLimit;      // bytes
    private long memorySwap;       // bytes
    private int cpuShares;         // relative weight
    private long cpuPeriod;        // microseconds
    private long cpuQuota;         // microseconds
    private int pidsLimit;         // max processes
    
    public long getMemoryLimit() { return memoryLimit; }
    public void setMemoryLimit(long limit) { this.memoryLimit = limit; }
    public int getCpuShares() { return cpuShares; }
    public void setCpuShares(int shares) { this.cpuShares = shares; }
    public long getCpuQuota() { return cpuQuota; }
    public void setCpuQuota(long quota) { this.cpuQuota = quota; }
    public int getPidsLimit() { return pidsLimit; }
    public void setPidsLimit(int limit) { this.pidsLimit = limit; }
}

/**
 * Network configuration
 */
class NetworkConfig {
    private String mode;           // bridge, host, none
    private List<String> ports;    // port mappings
    private String ipAddress;
    
    public String getMode() { return mode; }
    public void setMode(String mode) { this.mode = mode; }
    public List<String> getPorts() { return ports; }
    public String getIpAddress() { return ipAddress; }
}

/**
 * Container state
 */
enum ContainerState {
    CREATED,
    RUNNING,
    PAUSED,
    STOPPED,
    EXITED
}

package com.mydocker.native;

import java.io.*;
import java.nio.file.*;

/**
 * JNI wrapper for Linux syscalls needed for containers
 * 
 * In a real implementation, you'd compile the C code and load
 * the native library. For demonstration, we'll use process-based
 * alternatives where possible.
 */
public class LinuxSyscalls {
    
    // Clone flags for namespaces
    public static final int CLONE_NEWPID = 0x20000000;
    public static final int CLONE_NEWNS  = 0x00020000;  // Mount namespace
    public static final int CLONE_NEWNET = 0x40000000;
    public static final int CLONE_NEWUTS = 0x04000000;
    public static final int CLONE_NEWIPC = 0x08000000;
    public static final int CLONE_NEWUSER = 0x10000000;
    
    // Mount flags
    public static final int MS_BIND = 4096;
    public static final int MS_PRIVATE = 1 << 18;
    public static final int MS_REC = 16384;
    
    static {
        try {
            System.loadLibrary("mydocker_native");
        } catch (UnsatisfiedLinkError e) {
            System.err.println("Warning: Native library not found, using process-based fallbacks");
        }
    }
    
    // Native methods (would be implemented in C)
    public native static int clone(int flags);
    public native static int unshare(int flags);
    public native static int setns(int fd, int nstype);
    public native static int mount(String source, String target, String fstype, long flags, String data);
    public native static int umount(String target);
    public native static int pivot_root(String new_root, String put_old);
    public native static int chroot(String path);
    public native static int sethostname(String name);
    public native static int setuid(int uid);
    public native static int setgid(int gid);
    
    /**
     * Execute unshare command to create namespaces
     * Fallback when native library isn't available
     */
    public static ProcessBuilder createNamespacedProcess(String... command) {
        // Use unshare command as fallback
        String[] unshareCmd = new String[command.length + 7];
        unshareCmd[0] = "unshare";
        unshareCmd[1] = "--pid";
        unshareCmd[2] = "--mount";
        unshareCmd[3] = "--uts";
        unshareCmd[4] = "--ipc";
        unshareCmd[5] = "--fork";
        unshareCmd[6] = "--mount-proc";
        System.arraycopy(command, 0, unshareCmd, 7, command.length);
        
        return new ProcessBuilder(unshareCmd);
    }
    
    /**
     * Create a cgroup for resource limits
     */
    public static void createCgroup(String name, String controller) throws IOException {
        Path cgroupPath = Paths.get("/sys/fs/cgroup", controller, "mydocker", name);
        Files.createDirectories(cgroupPath);
    }
    
    /**
     * Set cgroup limit
     */
    public static void setCgroupLimit(String name, String controller, String file, String value) 
            throws IOException {
        Path limitPath = Paths.get("/sys/fs/cgroup", controller, "mydocker", name, file);
        Files.writeString(limitPath, value);
    }
    
    /**
     * Add process to cgroup
     */
    public static void addToCgroup(String name, String controller, int pid) throws IOException {
        Path procsPath = Paths.get("/sys/fs/cgroup", controller, "mydocker", name, "cgroup.procs");
        Files.writeString(procsPath, String.valueOf(pid));
    }
    
    /**
     * Setup overlay filesystem
     */
    public static void mountOverlay(Path lowerDir, Path upperDir, Path workDir, Path mergedDir) 
            throws IOException {
        Files.createDirectories(upperDir);
        Files.createDirectories(workDir);
        Files.createDirectories(mergedDir);
        
        String options = String.format(
            "lowerdir=%s,upperdir=%s,workdir=%s",
            lowerDir.toAbsolutePath(),
            upperDir.toAbsolutePath(),
            workDir.toAbsolutePath()
        );
        
        ProcessBuilder pb = new ProcessBuilder(
            "mount", "-t", "overlay", "overlay",
            "-o", options,
            mergedDir.toAbsolutePath().toString()
        );
        
        try {
            Process p = pb.start();
            int exitCode = p.waitFor();
            if (exitCode != 0) {
                throw new IOException("Failed to mount overlay filesystem");
            }
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
            throw new IOException("Mount interrupted", e);
        }
    }
}

package com.mydocker.runtime;

import com.mydocker.native.LinuxSyscalls;
import java.io.*;
import java.nio.file.*;

/**
 * Manages Linux namespaces for container isolation
 */
public class Namespace {
    
    /**
     * Create and enter a new PID namespace
     * 
     * PID namespace isolates process IDs. The first process in a new
     * PID namespace becomes PID 1 (like init).
     */
    public static void enterPidNamespace() throws IOException {
        // Using unshare syscall (would be native in production)
        executeCommand("unshare", "--pid", "--fork", "--mount-proc");
    }
    
    /**
     * Create and enter a new mount namespace
     * 
     * Mount namespace isolates the filesystem mount table.
     * Changes to mounts in one namespace don't affect others.
     */
    public static void enterMountNamespace() throws IOException {
        executeCommand("unshare", "--mount");
    }
    
    /**
     * Create and enter a new network namespace
     * 
     * Network namespace provides a complete isolated network stack:
     * - Separate network devices
     * - IP addresses
     * - Routing table
     * - Firewall rules
     */
    public static void enterNetworkNamespace() throws IOException {
        executeCommand("unshare", "--net");
    }
    
    /**
     * Create and enter a new UTS namespace
     * 
     * UTS namespace isolates hostname and domain name.
     * Allows each container to have its own hostname.
     */
    public static void setupUtsNamespace(String hostname) throws IOException {
        // In new UTS namespace, set hostname
        executeCommand("hostname", hostname);
    }
    
    /**
     * Create and enter a new user namespace
     * 
     * User namespace maps user/group IDs between container and host.
     * Allows running as root inside container but unprivileged outside.
     */
    public static void setupUserNamespace(int containerUid, int hostUid) throws IOException {
        // Write UID mapping
        Path uidMap = Paths.get("/proc/self/uid_map");
        String mapping = String.format("%d %d 1\n", containerUid, hostUid);
        Files.writeString(uidMap, mapping);
        
        // Disable setgroups (required before writing gid_map)
        Path setgroups = Paths.get("/proc/self/setgroups");
        Files.writeString(setgroups, "deny\n");
        
        // Write GID mapping
        Path gidMap = Paths.get("/proc/self/gid_map");
        Files.writeString(gidMap, mapping);
    }
    
    /**
     * Setup isolated mount namespace with pivot_root
     * 
     * This is the key to filesystem isolation:
     * 1. Mount the container's root filesystem
     * 2. pivot_root to make it the new root
     * 3. Unmount the old root
     */
    public static void setupRootfs(Path containerRoot) throws IOException {
        Path putOld = containerRoot.resolve("oldrootfs");
        Files.createDirectories(putOld);
        
        // Make the mount private so changes don't propagate
        executeCommand("mount", "--make-rprivate", "/");
        
        // Bind mount the container root to itself (required for pivot_root)
        executeCommand("mount", "--bind", 
            containerRoot.toAbsolutePath().toString(),
            containerRoot.toAbsolutePath().toString()
        );
        
        // pivot_root: swap root filesystem
        // Old root goes to putOld, containerRoot becomes new root
        executeCommand("pivot_root", 
            containerRoot.toAbsolutePath().toString(),
            putOld.toAbsolutePath().toString()
        );
        
        // Change to new root
        System.setProperty("user.dir", "/");
        
        // Unmount old root
        executeCommand("umount", "-l", "/oldrootfs");
        
        // Remove the old root directory
        Files.deleteIfExists(Paths.get("/oldrootfs"));
    }
    
    /**
     * Mount essential filesystems inside the container
     */
    public static void mountEssentialFilesystems(Path containerRoot) throws IOException {
        // Mount /proc - provides process information
        Path proc = containerRoot.resolve("proc");
        Files.createDirectories(proc);
        executeCommand("mount", "-t", "proc", "proc", proc.toAbsolutePath().toString());
        
        // Mount /sys - provides kernel/hardware information
        Path sys = containerRoot.resolve("sys");
        Files.createDirectories(sys);
        executeCommand("mount", "-t", "sysfs", "sysfs", sys.toAbsolutePath().toString());
        
        // Mount /dev - device files
        Path dev = containerRoot.resolve("dev");
        Files.createDirectories(dev);
        executeCommand("mount", "-t", "tmpfs", "tmpfs", dev.toAbsolutePath().toString());
        
        // Create essential device nodes
        createDeviceNodes(dev);
        
        // Mount /dev/pts - pseudo-terminals
        Path devPts = dev.resolve("pts");
        Files.createDirectories(devPts);
        executeCommand("mount", "-t", "devpts", "devpts", devPts.toAbsolutePath().toString());
        
        // Mount /dev/shm - shared memory
        Path devShm = dev.resolve("shm");
        Files.createDirectories(devShm);
        executeCommand("mount", "-t", "tmpfs", "tmpfs", devShm.toAbsolutePath().toString());
    }
    
    private static void createDeviceNodes(Path dev) throws IOException {
        // Create null, zero, random, urandom, tty, console
        executeCommand("mknod", "-m", "666", dev.resolve("null").toString(), "c", "1", "3");
        executeCommand("mknod", "-m", "666", dev.resolve("zero").toString(), "c", "1", "5");
        executeCommand("mknod", "-m", "666", dev.resolve("random").toString(), "c", "1", "8");
        executeCommand("mknod", "-m", "666", dev.resolve("urandom").toString(), "c", "1", "9");
        executeCommand("mknod", "-m", "666", dev.resolve("tty").toString(), "c", "5", "0");
        executeCommand("mknod", "-m", "600", dev.resolve("console").toString(), "c", "5", "1");
        
        // Create symlinks
        Files.createSymbolicLink(dev.resolve("fd"), Paths.get("/proc/self/fd"));
        Files.createSymbolicLink(dev.resolve("stdin"), Paths.get("/proc/self/fd/0"));
        Files.createSymbolicLink(dev.resolve("stdout"), Paths.get("/proc/self/fd/1"));
        Files.createSymbolicLink(dev.resolve("stderr"), Paths.get("/proc/self/fd/2"));
    }
    
    private static void executeCommand(String... command) throws IOException {
        ProcessBuilder pb = new ProcessBuilder(command);
        pb.inheritIO();
        try {
            Process p = pb.start();
            int exitCode = p.waitFor();
            if (exitCode != 0) {
                throw new IOException("Command failed with exit code " + exitCode + 
                    ": " + String.join(" ", command));
            }
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
            throw new IOException("Command interrupted", e);
        }
    }
}

package com.mydocker.runtime;

import com.mydocker.container.ContainerConfig;
import java.io.*;
import java.nio.file.*;

/**
 * Manages cgroups for resource limits
 * 
 * Cgroups (control groups) limit and account for resource usage:
 * - CPU time
 * - Memory
 * - Disk I/O
 * - Network bandwidth
 * - Number of processes
 */
public class Cgroup {
    
    // Cgroup v2 unified hierarchy path
    private static final Path CGROUP_ROOT = Paths.get("/sys/fs/cgroup");
    private static final String MYDOCKER_SLICE = "mydocker.slice";
    
    private final String containerId;
    private final Path cgroupPath;
    
    public Cgroup(String containerId) {
        this.containerId = containerId;
        this.cgroupPath = CGROUP_ROOT.resolve(MYDOCKER_SLICE).resolve(containerId);
    }
    
    /**
     * Create the cgroup for this container
     */
    public void create() throws IOException {
        // Create the cgroup directory
        Files.createDirectories(cgroupPath);
        
        // Enable controllers we need
        enableControllers();
    }
    
    /**
     * Apply resource limits from configuration
     */
    public void applyLimits(ContainerConfig config) throws IOException {
        var resources = config.getResources();
        if (resources == null) return;
        
        // Memory limit
        if (resources.getMemoryLimit() > 0) {
            setMemoryLimit(resources.getMemoryLimit());
        }
        
        // CPU limit
        if (resources.getCpuQuota() > 0) {
            setCpuLimit(resources.getCpuQuota());
        }
        
        // PIDs limit
        if (resources.getPidsLimit() > 0) {
            setPidsLimit(resources.getPidsLimit());
        }
    }
    
    /**
     * Set memory limit
     * 
     * memory.max: hard limit in bytes
     * memory.high: throttling limit (soft limit)
     */
    public void setMemoryLimit(long bytes) throws IOException {
        // Hard limit
        writeCgroupFile("memory.max", String.valueOf(bytes));
        
        // Soft limit at 90% of hard limit
        writeCgroupFile("memory.high", String.valueOf((long)(bytes * 0.9)));
    }
    
    /**
     * Set CPU limit using CPU quota/period
     * 
     * cpu.max: "quota period"
     * quota: microseconds of CPU time per period
     * period: length of period in microseconds (default 100000 = 100ms)
     * 
     * Example: "50000 100000" = 50% of one CPU
     *          "200000 100000" = 2 CPUs worth
     */
    public void setCpuLimit(long quotaMicros) throws IOException {
        String value = quotaMicros + " 100000";  // quota and 100ms period
        writeCgroupFile("cpu.max", value);
    }
    
    /**
     * Set PIDs limit
     * 
     * pids.max: maximum number of processes
     */
    public void setPidsLimit(int limit) throws IOException {
        writeCgroupFile("pids.max", String.valueOf(limit));
    }
    
    /**
     * Add a process to this cgroup
     */
    public void addProcess(int pid) throws IOException {
        writeCgroupFile("cgroup.procs", String.valueOf(pid));
    }
    
    /**
     * Get current memory usage
     */
    public long getMemoryUsage() throws IOException {
        String content = Files.readString(cgroupPath.resolve("memory.current")).trim();
        return Long.parseLong(content);
    }
    
    /**
     * Get current CPU usage statistics
     */
    public CpuStats getCpuStats() throws IOException {
        String content = Files.readString(cgroupPath.resolve("cpu.stat"));
        CpuStats stats = new CpuStats();
        
        for (String line : content.split("\n")) {
            String[] parts = line.split(" ");
            if (parts.length == 2) {
                switch (parts[0]) {
                    case "usage_usec":
                        stats.usageUsec = Long.parseLong(parts[1]);
                        break;
                    case "user_usec":
                        stats.userUsec = Long.parseLong(parts[1]);
                        break;
                    case "system_usec":
                        stats.systemUsec = Long.parseLong(parts[1]);
                        break;
                }
            }
        }
        
        return stats;
    }
    
    /**
     * Remove the cgroup
     */
    public void remove() throws IOException {
        // First, kill all processes in the cgroup
        try {
            String procs = Files.readString(cgroupPath.resolve("cgroup.procs"));
            for (String pidStr : procs.split("\n")) {
                if (!pidStr.isEmpty()) {
                    int pid = Integer.parseInt(pidStr.trim());
                    Runtime.getRuntime().exec(new String[]{"kill", "-9", String.valueOf(pid)});
                }
            }
        } catch (IOException e) {
            // Ignore - cgroup might be empty
        }
        
        // Wait a bit for processes to die
        try { Thread.sleep(100); } catch (InterruptedException e) {}
        
        // Remove the cgroup directory
        Files.deleteIfExists(cgroupPath);
    }
    
    private void enableControllers() throws IOException {
        // In cgroup v2, we need to enable controllers at the parent level
        Path parentSubtreeControl = cgroupPath.getParent().resolve("cgroup.subtree_control");
        
        if (Files.exists(parentSubtreeControl)) {
            // Enable memory, cpu, and pids controllers
            Files.writeString(parentSubtreeControl, "+memory +cpu +pids\n");
        }
    }
    
    private void writeCgroupFile(String filename, String value) throws IOException {
        Path file = cgroupPath.resolve(filename);
        Files.writeString(file, value);
    }
    
    /**
     * CPU statistics holder
     */
    public static class CpuStats {
        public long usageUsec;
        public long userUsec;
        public long systemUsec;
    }
}

package com.mydocker.runtime;

import com.mydocker.image.Image;
import com.mydocker.image.Layer;
import java.io.*;
import java.nio.file.*;
import java.util.*;

/**
 * Manages container filesystem using overlay filesystem
 * 
 * Overlay FS allows stacking multiple directories:
 * - lowerdir: read-only base layers (image layers)
 * - upperdir: read-write layer (container changes)
 * - workdir: internal work directory
 * - merged: the combined view seen by the container
 */
public class Filesystem {
    
    private static final Path CONTAINER_ROOT = Paths.get("/var/lib/mydocker/containers");
    private static final Path IMAGE_ROOT = Paths.get("/var/lib/mydocker/images");
    
    private final String containerId;
    private final Path containerDir;
    private final Path rootfs;
    private final Path upperDir;
    private final Path workDir;
    
    public Filesystem(String containerId) {
        this.containerId = containerId;
        this.containerDir = CONTAINER_ROOT.resolve(containerId);
        this.rootfs = containerDir.resolve("rootfs");
        this.upperDir = containerDir.resolve("upper");
        this.workDir = containerDir.resolve("work");
    }
    
    /**
     * Setup the overlay filesystem for a container
     */
    public Path setup(Image image) throws IOException {
        // Create container directories
        Files.createDirectories(containerDir);
        Files.createDirectories(rootfs);
        Files.createDirectories(upperDir);
        Files.createDirectories(workDir);
        
        // Get lower directories from image layers
        List<Path> lowerDirs = new ArrayList<>();
        for (Layer layer : image.getLayers()) {
            lowerDirs.add(layer.getPath());
        }
        
        // Mount overlay filesystem
        mountOverlay(lowerDirs);
        
        return rootfs;
    }
    
    /**
     * Mount overlay filesystem
     */
    private void mountOverlay(List<Path> lowerDirs) throws IOException {
        // Build lowerdir option (layers in reverse order, bottom first)
        StringBuilder lowerOpt = new StringBuilder();
        for (int i = lowerDirs.size() - 1; i >= 0; i--) {
            if (lowerOpt.length() > 0) lowerOpt.append(":");
            lowerOpt.append(lowerDirs.get(i).toAbsolutePath());
        }
        
        String options = String.format(
            "lowerdir=%s,upperdir=%s,workdir=%s",
            lowerOpt.toString(),
            upperDir.toAbsolutePath(),
            workDir.toAbsolutePath()
        );
        
        ProcessBuilder pb = new ProcessBuilder(
            "mount", "-t", "overlay", "overlay",
            "-o", options,
            rootfs.toAbsolutePath().toString()
        );
        
        pb.inheritIO();
        
        try {
            Process p = pb.start();
            int exitCode = p.waitFor();
            if (exitCode != 0) {
                throw new IOException("Failed to mount overlay: exit code " + exitCode);
            }
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
            throw new IOException("Mount interrupted", e);
        }
    }
    
    /**
     * Setup essential filesystem structure inside container
     */
    public void setupContainerFs() throws IOException {
        // Create essential directories
        Files.createDirectories(rootfs.resolve("proc"));
        Files.createDirectories(rootfs.resolve("sys"));
        Files.createDirectories(rootfs.resolve("dev"));
        Files.createDirectories(rootfs.resolve("tmp"));
        Files.createDirectories(rootfs.resolve("run"));
        Files.createDirectories(rootfs.resolve("etc"));
        
        // Create /etc/hostname
        Files.writeString(rootfs.resolve("etc/hostname"), containerId.substring(0, 12) + "\n");
        
        // Create /etc/hosts
        String hosts = """
            127.0.0.1   localhost
            ::1         localhost ip6-localhost ip6-loopback
            """;
        Files.writeString(rootfs.resolve("etc/hosts"), hosts);
        
        // Create /etc/resolv.conf (copy from host)
        Path hostResolv = Paths.get("/etc/resolv.conf");
        if (Files.exists(hostResolv)) {
            Files.copy(hostResolv, rootfs.resolve("etc/resolv.conf"), 
                StandardCopyOption.REPLACE_EXISTING);
        }
    }
    
    /**
     * Mount a volume into the container
     */
    public void mountVolume(String hostPath, String containerPath) throws IOException {
        Path target = rootfs.resolve(containerPath.startsWith("/") ? 
            containerPath.substring(1) : containerPath);
        
        Files.createDirectories(target);
        
        ProcessBuilder pb = new ProcessBuilder(
            "mount", "--bind", hostPath, target.toAbsolutePath().toString()
        );
        
        pb.inheritIO();
        
        try {
            Process p = pb.start();
            p.waitFor();
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
        }
    }
    
    /**
     * Cleanup filesystem (unmount and remove)
     */
    public void cleanup() throws IOException {
        // Unmount overlay
        try {
            new ProcessBuilder("umount", rootfs.toAbsolutePath().toString())
                .inheritIO()
                .start()
                .waitFor();
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
        }
        
        // Remove container directory
        deleteRecursively(containerDir);
    }
    
    /**
     * Get changes made in the container (upper layer contents)
     */
    public List<String> getChanges() throws IOException {
        List<String> changes = new ArrayList<>();
        
        Files.walk(upperDir)
            .filter(p -> !p.equals(upperDir))
            .forEach(p -> {
                String relativePath = upperDir.relativize(p).toString();
                if (Files.isDirectory(p)) {
                    changes.add("A /" + relativePath + "/");
                } else {
                    changes.add("A /" + relativePath);
                }
            });
        
        return changes;
    }
    
    public Path getRootfs() {
        return rootfs;
    }
    
    private void deleteRecursively(Path path) throws IOException {
        if (Files.exists(path)) {
            Files.walk(path)
                .sorted(Comparator.reverseOrder())
                .forEach(p -> {
                    try {
                        Files.delete(p);
                    } catch (IOException e) {
                        // Ignore
                    }
                });
        }
    }
}

package com.mydocker.network;

import java.io.*;
import java.nio.file.*;
import java.util.*;

/**
 * Container networking implementation
 * 
 * Creates a bridge network similar to Docker's default bridge:
 * - Bridge device on host (mydocker0)
 * - Veth pair connecting container to bridge
 * - NAT rules for outbound traffic
 * - Port forwarding for inbound traffic
 */
public class Network {
    
    private static final String BRIDGE_NAME = "mydocker0";
    private static final String BRIDGE_IP = "172.17.0.1";
    private static final String BRIDGE_SUBNET = "172.17.0.0/16";
    private static final int IP_POOL_START = 2;  // Start at 172.17.0.2
    
    private static int nextIp = IP_POOL_START;
    
    /**
     * Initialize the default bridge network
     */
    public static void initBridge() throws IOException {
        // Check if bridge already exists
        if (bridgeExists()) {
            return;
        }
        
        // Create bridge device
        executeIp("link", "add", BRIDGE_NAME, "type", "bridge");
        
        // Assign IP address
        executeIp("addr", "add", BRIDGE_IP + "/16", "dev", BRIDGE_NAME);
        
        // Bring bridge up
        executeIp("link", "set", BRIDGE_NAME, "up");
        
        // Enable IP forwarding
        Files.writeString(Paths.get("/proc/sys/net/ipv4/ip_forward"), "1");
        
        // Add NAT rule for outbound traffic
        execute("iptables", "-t", "nat", "-A", "POSTROUTING", 
            "-s", BRIDGE_SUBNET, "-j", "MASQUERADE");
    }
    
    /**
     * Connect a container to the bridge network
     * 
     * @param containerPid The PID of the container's init process
     * @param containerId The container ID (for naming)
     * @return The assigned IP address
     */
    public static String connect(int containerPid, String containerId) throws IOException {
        String vethHost = "veth" + containerId.substring(0, 6);
        String vethContainer = "eth0";
        String containerIp = "172.17.0." + (nextIp++);
        
        // Create veth pair
        executeIp("link", "add", vethHost, "type", "veth", "peer", "name", vethContainer);
        
        // Attach host end to bridge
        executeIp("link", "set", vethHost, "master", BRIDGE_NAME);
        executeIp("link", "set", vethHost, "up");
        
        // Move container end to container's network namespace
        executeIp("link", "set", vethContainer, "netns", String.valueOf(containerPid));
        
        // Configure container's network namespace
        executeNsenter(containerPid, "ip", "addr", "add", containerIp + "/16", "dev", vethContainer);
        executeNsenter(containerPid, "ip", "link", "set", vethContainer, "up");
        executeNsenter(containerPid, "ip", "link", "set", "lo", "up");
        executeNsenter(containerPid, "ip", "route", "add", "default", "via", BRIDGE_IP);
        
        return containerIp;
    }
    
    /**
     * Add port mapping from host to container
     * 
     * @param hostPort Port on the host
     * @param containerIp Container's IP address
     * @param containerPort Port in the container
     */
    public static void addPortMapping(int hostPort, String containerIp, int containerPort) 
            throws IOException {
        // DNAT rule to forward incoming traffic
        execute("iptables", "-t", "nat", "-A", "PREROUTING",
            "-p", "tcp", "--dport", String.valueOf(hostPort),
            "-j", "DNAT", "--to-destination", containerIp + ":" + containerPort);
        
        // Also handle local traffic
        execute("iptables", "-t", "nat", "-A", "OUTPUT",
            "-p", "tcp", "--dport", String.valueOf(hostPort),
            "-j", "DNAT", "--to-destination", containerIp + ":" + containerPort);
    }
    
    /**
     * Remove port mapping
     */
    public static void removePortMapping(int hostPort, String containerIp, int containerPort) 
            throws IOException {
        execute("iptables", "-t", "nat", "-D", "PREROUTING",
            "-p", "tcp", "--dport", String.valueOf(hostPort),
            "-j", "DNAT", "--to-destination", containerIp + ":" + containerPort);
        
        execute("iptables", "-t", "nat", "-D", "OUTPUT",
            "-p", "tcp", "--dport", String.valueOf(hostPort),
            "-j", "DNAT", "--to-destination", containerIp + ":" + containerPort);
    }
    
    /**
     * Disconnect container from network
     */
    public static void disconnect(String containerId) throws IOException {
        String vethHost = "veth" + containerId.substring(0, 6);
        
        // Deleting the host end also deletes the container end
        try {
            executeIp("link", "delete", vethHost);
        } catch (IOException e) {
            // Ignore if already deleted
        }
    }
    
    private static boolean bridgeExists() {
        try {
            ProcessBuilder pb = new ProcessBuilder("ip", "link", "show", BRIDGE_NAME);
            return pb.start().waitFor() == 0;
        } catch (Exception e) {
            return false;
        }
    }
    
    private static void executeIp(String... args) throws IOException {
        String[] cmd = new String[args.length + 1];
        cmd[0] = "ip";
        System.arraycopy(args, 0, cmd, 1, args.length);
        execute(cmd);
    }
    
    private static void executeNsenter(int pid, String... args) throws IOException {
        String[] cmd = new String[args.length + 4];
        cmd[0] = "nsenter";
        cmd[1] = "-t";
        cmd[2] = String.valueOf(pid);
        cmd[3] = "-n";
        System.arraycopy(args, 0, cmd, 4, args.length);
        execute(cmd);
    }
    
    private static void execute(String... cmd) throws IOException {
        ProcessBuilder pb = new ProcessBuilder(cmd);
        pb.inheritIO();
        
        try {
            Process p = pb.start();
            int exitCode = p.waitFor();
            if (exitCode != 0) {
                throw new IOException("Command failed: " + String.join(" ", cmd));
            }
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
            throw new IOException("Command interrupted", e);
        }
    }
}

package com.mydocker.runtime;

import com.mydocker.container.*;
import com.mydocker.image.*;
import com.mydocker.network.Network;
import java.io.*;
import java.nio.file.*;
import java.util.*;
import java.util.concurrent.*;

/**
 * Container runtime - orchestrates container lifecycle
 */
public class Runtime {
    
    private static final Path RUNTIME_ROOT = Paths.get("/var/lib/mydocker");
    private static final Path CONTAINERS_PATH = RUNTIME_ROOT.resolve("containers");
    
    private final Map<String, Container> containers = new ConcurrentHashMap<>();
    private final ImageStore imageStore;
    
    public Runtime() {
        this.imageStore = new ImageStore();
        initializeRuntime();
    }
    
    private void initializeRuntime() {
        try {
            Files.createDirectories(CONTAINERS_PATH);
            Network.initBridge();
        } catch (IOException e) {
            throw new RuntimeException("Failed to initialize runtime", e);
        }
    }
    
    /**
     * Create and start a container
     */
    public Container run(ContainerConfig config) throws IOException {
        // 1. Pull image if needed
        Image image = imageStore.getOrPull(config.getImage());
        
        // 2. Create container
        Container container = new Container(config);
        containers.put(container.getId(), container);
        
        // 3. Setup filesystem
        Filesystem fs = new Filesystem(container.getId());
        Path rootfs = fs.setup(image);
        fs.setupContainerFs();
        container.setRootfs(rootfs);
        
        // 4. Setup cgroups
        Cgroup cgroup = new Cgroup(container.getId());
        cgroup.create();
        cgroup.applyLimits(config);
        
        // 5. Start container process
        int pid = startContainerProcess(container, rootfs);
        container.setPid(pid);
        container.setState(ContainerState.RUNNING);
        
        // 6. Add process to cgroup
        cgroup.addProcess(pid);
        
        // 7. Setup networking
        if (!"none".equals(config.getNetwork().getMode())) {
            String ip = Network.connect(pid, container.getId());
            config.getNetwork().setIpAddress(ip);
            
            // Setup port mappings
            for (String mapping : config.getNetwork().getPorts()) {
                String[] parts = mapping.split(":");
                int hostPort = Integer.parseInt(parts[0]);
                int containerPort = Integer.parseInt(parts[1]);
                Network.addPortMapping(hostPort, ip, containerPort);
            }
        }
        
        return container;
    }
    
    private int startContainerProcess(Container container, Path rootfs) throws IOException {
        ContainerConfig config = container.getConfig();
        List<String> command = config.getCommand();
        
        // Build the command with unshare for namespace isolation
        List<String> fullCommand = new ArrayList<>();
        fullCommand.add("unshare");
        fullCommand.add("--pid");
        fullCommand.add("--mount");
        fullCommand.add("--uts");
        fullCommand.add("--ipc");
        fullCommand.add("--fork");
        fullCommand.add("--root=" + rootfs.toAbsolutePath());
        fullCommand.add("--mount-proc");
        
        // Set hostname if specified
        if (config.getHostname() != null) {
            fullCommand.add("--uts");
        }
        
        fullCommand.addAll(command);
        
        ProcessBuilder pb = new ProcessBuilder(fullCommand);
        
        // Set environment variables
        Map<String, String> env = pb.environment();
        env.clear();
        env.put("PATH", "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin");
        env.put("TERM", "xterm");
        env.put("HOME", "/root");
        
        if (config.getEnv() != null) {
            env.putAll(config.getEnv());
        }
        
        if (config.isTty() || config.isInteractive()) {
            pb.inheritIO();
        }
        
        Process process = pb.start();
        
        // Get the actual PID (the unshare process)
        return (int) process.pid();
    }
    
    /**
     * Stop a running container
     */
    public void stop(String containerId) throws IOException {
        Container container = containers.get(containerId);
        if (container == null) {
            throw new IllegalArgumentException("Container not found: " + containerId);
        }
        
        // Send SIGTERM to container process
        ProcessBuilder pb = new ProcessBuilder("kill", "-15", String.valueOf(container.getPid()));
        pb.start().waitFor(10, TimeUnit.SECONDS);
        
        container.setState(ContainerState.STOPPED);
    }
    
    /**
     * Remove a container
     */
    public void remove(String containerId) throws IOException {
        Container container = containers.get(containerId);
        if (container == null) {
            throw new IllegalArgumentException("Container not found: " + containerId);
        }
        
        // Force stop if running
        if (container.getState() == ContainerState.RUNNING) {
            ProcessBuilder pb = new ProcessBuilder("kill", "-9", String.valueOf(container.getPid()));
            try {
                pb.start().waitFor();
            } catch (InterruptedException e) {
                Thread.currentThread().interrupt();
            }
        }
        
        // Cleanup networking
        Network.disconnect(containerId);
        
        // Cleanup cgroup
        Cgroup cgroup = new Cgroup(containerId);
        cgroup.remove();
        
        // Cleanup filesystem
        Filesystem fs = new Filesystem(containerId);
        fs.cleanup();
        
        containers.remove(containerId);
    }
    
    /**
     * List all containers
     */
    public List<Container> list() {
        return new ArrayList<>(containers.values());
    }
    
    /**
     * Get container by ID
     */
    public Container get(String containerId) {
        return containers.get(containerId);
    }
    
    /**
     * Execute command in running container
     */
    public int exec(String containerId, List<String> command) throws IOException {
        Container container = containers.get(containerId);
        if (container == null || container.getState() != ContainerState.RUNNING) {
            throw new IllegalStateException("Container not running: " + containerId);
        }
        
        // Use nsenter to enter container's namespaces
        List<String> nsenterCmd = new ArrayList<>();
        nsenterCmd.add("nsenter");
        nsenterCmd.add("-t");
        nsenterCmd.add(String.valueOf(container.getPid()));
        nsenterCmd.add("-m");  // mount namespace
        nsenterCmd.add("-u");  // UTS namespace
        nsenterCmd.add("-i");  // IPC namespace
        nsenterCmd.add("-n");  // network namespace
        nsenterCmd.add("-p");  // PID namespace
        nsenterCmd.addAll(command);
        
        ProcessBuilder pb = new ProcessBuilder(nsenterCmd);
        pb.inheritIO();
        
        try {
            Process p = pb.start();
            return p.waitFor();
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
            return -1;
        }
    }
}

package com.mydocker.cli;

import com.mydocker.container.*;
import com.mydocker.runtime.Runtime;
import java.util.*;

/**
 * Command-line interface for mydocker
 */
public class CLI {
    
    private final Runtime runtime;
    
    public CLI() {
        this.runtime = new Runtime();
    }
    
    public void run(String[] args) {
        if (args.length == 0) {
            printUsage();
            return;
        }
        
        String command = args[0];
        String[] cmdArgs = Arrays.copyOfRange(args, 1, args.length);
        
        try {
            switch (command) {
                case "run" -> handleRun(cmdArgs);
                case "ps" -> handlePs(cmdArgs);
                case "stop" -> handleStop(cmdArgs);
                case "rm" -> handleRemove(cmdArgs);
                case "exec" -> handleExec(cmdArgs);
                case "images" -> handleImages(cmdArgs);
                case "pull" -> handlePull(cmdArgs);
                default -> {
                    System.err.println("Unknown command: " + command);
                    printUsage();
                }
            }
        } catch (Exception e) {
            System.err.println("Error: " + e.getMessage());
            e.printStackTrace();
        }
    }
    
    private void handleRun(String[] args) throws Exception {
        ContainerConfig.Builder builder = new ContainerConfig.Builder();
        List<String> command = new ArrayList<>();
        
        int i = 0;
        while (i < args.length) {
            switch (args[i]) {
                case "-d", "--detach" -> {
                    // Run in background
                    i++;
                }
                case "-it" -> {
                    builder.tty(true).interactive(true);
                    i++;
                }
                case "--name" -> {
                    builder.name(args[++i]);
                    i++;
                }
                case "-e", "--env" -> {
                    String[] env = args[++i].split("=", 2);
                    builder.env(Map.of(env[0], env.length > 1 ? env[1] : ""));
                    i++;
                }
                case "-m", "--memory" -> {
                    long mem = parseMemory(args[++i]);
                    ResourceLimits limits = new ResourceLimits();
                    limits.setMemoryLimit(mem);
                    builder.resources(limits);
                    i++;
                }
                case "-p", "--publish" -> {
                    NetworkConfig net = new NetworkConfig();
                    net.setMode("bridge");
                    net.setPorts(List.of(args[++i]));
                    builder.network(net);
                    i++;
                }
                default -> {
                    if (!args[i].startsWith("-")) {
                        builder.image(args[i]);
                        command.addAll(Arrays.asList(Arrays.copyOfRange(args, i + 1, args.length)));
                        i = args.length;
                    } else {
                        i++;
                    }
                }
            }
        }
        
        if (command.isEmpty()) {
            command.add("/bin/sh");
        }
        builder.command(command);
        
        Container container = runtime.run(builder.build());
        System.out.println(container.getId());
    }
    
    private void handlePs(String[] args) {
        boolean all = Arrays.asList(args).contains("-a");
        
        System.out.printf("%-12s %-20s %-15s %-10s %-20s%n",
            "CONTAINER ID", "IMAGE", "COMMAND", "STATUS", "NAMES");
        
        for (Container c : runtime.list()) {
            if (!all && c.getState() != ContainerState.RUNNING) continue;
            
            String cmd = String.join(" ", c.getConfig().getCommand());
            if (cmd.length() > 15) cmd = cmd.substring(0, 12) + "...";
            
            System.out.printf("%-12s %-20s %-15s %-10s %-20s%n",
                c.getId().substring(0, 12),
                c.getConfig().getImage(),
                cmd,
                c.getState().toString().toLowerCase(),
                c.getName()
            );
        }
    }
    
    private void handleStop(String[] args) throws Exception {
        for (String id : args) {
            runtime.stop(id);
            System.out.println(id);
        }
    }
    
    private void handleRemove(String[] args) throws Exception {
        for (String id : args) {
            runtime.remove(id);
            System.out.println(id);
        }
    }
    
    private void handleExec(String[] args) throws Exception {
        if (args.length < 2) {
            System.err.println("Usage: mydocker exec CONTAINER COMMAND [ARG...]");
            return;
        }
        
        String containerId = args[0];
        List<String> command = Arrays.asList(Arrays.copyOfRange(args, 1, args.length));
        
        int exitCode = runtime.exec(containerId, command);
        System.exit(exitCode);
    }
    
    private void handleImages(String[] args) {
        System.out.printf("%-20s %-15s %-15s %-15s%n",
            "REPOSITORY", "TAG", "IMAGE ID", "SIZE");
        // List images from image store
    }
    
    private void handlePull(String[] args) {
        if (args.length < 1) {
            System.err.println("Usage: mydocker pull IMAGE[:TAG]");
            return;
        }
        // Pull image from registry
        System.out.println("Pulling " + args[0] + "...");
    }
    
    private long parseMemory(String s) {
        s = s.toLowerCase();
        long multiplier = 1;
        if (s.endsWith("g")) {
            multiplier = 1024 * 1024 * 1024;
            s = s.substring(0, s.length() - 1);
        } else if (s.endsWith("m")) {
            multiplier = 1024 * 1024;
            s = s.substring(0, s.length() - 1);
        } else if (s.endsWith("k")) {
            multiplier = 1024;
            s = s.substring(0, s.length() - 1);
        }
        return Long.parseLong(s) * multiplier;
    }
    
    private void printUsage() {
        System.out.println("""
            Usage: mydocker COMMAND [OPTIONS]
            
            Commands:
              run         Create and run a new container
              ps          List containers
              stop        Stop running containers
              rm          Remove containers
              exec        Execute a command in a running container
              images      List images
              pull        Pull an image from a registry
            
            Run 'mydocker COMMAND --help' for more information on a command.
            """);
    }
    
    public static void main(String[] args) {
        new CLI().run(args);
    }
}

Testing Your Docker

# Build
mvn package

# Run a container (requires root)
sudo java -jar target/mydocker.jar run -it alpine /bin/sh

# Inside container
/ # hostname
abc123def456

/ # ps aux
PID   USER     TIME  COMMAND
    1 root      0:00 /bin/sh
    2 root      0:00 ps aux

/ # cat /etc/resolv.conf
# Container has network access

/ # exit

# List containers
sudo java -jar target/mydocker.jar ps -a

# Remove container
sudo java -jar target/mydocker.jar rm abc123

Advanced Exercises

Level 1: Core Improvements

Implement proper OCI image format support
Add container logging (capture stdout/stderr)
Implement container restart policies

Level 2: Production Features

Add seccomp filtering for security
Implement container health checks
Add volume mounting support

Level 3: Orchestration

Implement basic networking between containers
Add container-to-container DNS resolution
Build a simple container orchestrator

What You’ve Learned

Linux namespaces (PID, mount, network, UTS, user)

Cgroups for resource limits

Overlay filesystems and copy-on-write

Container networking (bridges, veth pairs, NAT)

OCI image format concepts

Container security mechanisms

Resume Impact

With this project, you can confidently say:

“Built a container runtime from scratch implementing Linux namespaces, cgroups, and overlay filesystems. Demonstrated deep understanding of kernel-level isolation, resource management, and container networking.”

This immediately signals staff-level systems expertise.

Next Steps

Go Implementation

See the more common Go implementation approach

JavaScript Implementation

Node.js with native bindings approach

Contribute to containerd

Take your skills to the actual project

​Build Your Own Docker

​Why Build Docker?

​Container Architecture Deep Dive

​What You’ll Build

​Core Features

​Interview Deep-Dive

​Implementation: Java

​Project Structure

​Core Implementation

​Testing Your Docker

​Advanced Exercises

​Level 1: Core Improvements

​Level 2: Production Features

​Level 3: Orchestration

​What You’ve Learned

​Resume Impact

​Next Steps

Go Implementation

JavaScript Implementation

Contribute to containerd

Build Your Own Docker

Why Build Docker?

Container Architecture Deep Dive

What You’ll Build

Core Features

Interview Deep-Dive

Implementation: Java

Project Structure

Core Implementation

Testing Your Docker

Advanced Exercises

Level 1: Core Improvements

Level 2: Production Features

Level 3: Orchestration

What You’ve Learned

Resume Impact

Next Steps