This is a pedagogical artifact, not a product. The article walks you through building a minimal Linux container runtime in roughly 500 lines of C, starting from clone(2) and working through user namespaces, PID namespaces, mount namespaces, and the security implications of each. The mechanism is show-don't-tell: every concept gets a minimal C listing you can compile and run, and the author verifies behavior empirically before citing the man page. The strongest section is the extended treatment of user namespace security. Rather than hand-waving about 'isolation,' the piece demonstrates — with working code — how an unprivileged user can create a network bridge after unshare(CLONENEWUSER | CLONENEWNET), effectively regaining capabilities that were stripped. It then immediately shows where that power stops: capsetfile fails, proving the namespace's capability set is scoped. This teach-by-contrast approach is rare in systems writing and genuinely effective. The distro survey is the other standout. Ubuntu's out-of-tree sysctl patch (unprivilegedusernsclone), Debian's identical patch with its 'short-term' disclaimer from 2013, Grsecurity's hard lockdown requiring CAPSYSADMIN + CAPSETUID + CAPSETGID, and Arch's refusal to patch upstream — all are presented with primary sources (commit messages, mailing list posts, Kconfig excerpts). The reader walks away understanding that 'user namespaces' is not a single feature but a policy decision each distro makes differently, with real security tradeoffs. The C code is deliberately minimal and well-commented. The clone stack example clarifies a subtle point about stack allocation direction on x86 and even chases a potential undefined-behavior question into ISO 9899 §6.5.6 to confirm the pointer arithmetic is legal. This is the kind of rigor that separates teaching material from blog posts. The PID namespace section establishes that waitpid on the namespace root is sufficient because the kernel SIGKILLs all children when init exits — and the author verified this independently before finding the man page confirmation. That workflow (test first, cite second) models exactly the right approach to systems programming. What's missing: the piece is incomplete. The content provided covers user namespaces, PID namespaces, stack mechanics, and security policy, but the persistentchild listing is truncated mid-code. There's no network namespace setup, no cgroup integration, no filesystem layering. The '500 lines' promise implies a complete runtime, but what we have is the careful foundation for one. The security discussion also omits Red Hat's approach — the author notes this gap honestly. As a learning resource, this is unusually good at its specific job: making you understand the kernel primitives that Docker and LXC abstract away, by forcing you to touch each one directly and see where it bites.
