Docker is weird
- ID
- 38670
- Status
- summarized
- Published
- 23 Oct 2026, 7:45 AM
- Fetched
- 23 Oct 2026, 4:59 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://codeandcake.dev/posts/2026-10-22-docker-is-weird
- Source URL
- https://hnrss.org/best
Summary
- Score
- 6.5
- Created
- 23 Oct 2026, 5:00 PM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
The author started building a container runtime for fun and writes up Docker surprises: containers are ordinary processes restricted by kernel features like namespaces and cgroups, and images are just folders that become a process’s root via chroot/pivot_root. The post also argues Go is awkward for runc because many setup syscalls need single-threaded execution, Go lacks fork, and runc approximates it by exec’ing /proc/self/exe with a special argv. It notes the Docker daemon usually runs as root and that rootless runtimes appear to need a userspace networking stack to match features.
Why it matters
Use this as a debugging mental model: when a container behaves oddly, check the process in /proc and the namespace/cgroup/network setup instead of treating it like a VM. If you’re evaluating rootless Docker or building tooling around containers, treat networking—not image storage—as the likely hard part; the post says rootless runtimes look like they must reimplement the networking stack in userspace.
Discussion angle
Which Docker abstraction hides the most production pain for your team: the root daemon, image-as-folder model, or rootless networking requiring a userspace stack?