--- title: How Docker Works Under the Hood: Watch Namespaces... description: A container is just a normal Linux process that the kernel isolates with namespaces and limits with cgroups. Two browser simulators walk the docker run... canonical: https://daily.dev/posts/gsemtnpu7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How Docker Works Under the Hood: Watch Namespaces Isolate a Container and cgroups Stop a Fork Bomb | daily.dev og:description: A container is just a normal Linux process that the kernel isolates with namespaces and limits with cgroups. Two browser simulators walk the docker run... og:url: https://daily.dev/posts/gsemtnpu7 og:image: https://api.daily.dev/og/posts/GSemtNpu7.png og:image:alt: Post cover image og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How Docker Works Under the Hood: Watch Namespaces Isolate a Container and cgroups Stop a Fork Bomb **[Bobby Iliev](https://daily.dev/sources/9adj6fgmy)** · [@bobbyiliev](https://daily.dev/bobbyiliev) · 85 upvotes · 4 comments ## Summary A container is just a normal Linux process that the kernel isolates with namespaces and limits with cgroups. Two browser simulators walk the docker run pipeline across eight stages, from the CLI's REST call to dockerd, through containerd and runc, down to the kernel. A fork bomb simulator shows a process table filling up until the PID limit (64 to 1024, default 512) is hit, producing 'FATAL: fork() failed'. Picking ulimit, cgroups, or systemd TasksMax caps the run at 100 processes instead. A real test with systemd-run and TasksMax=10 shows the tenth fork() failing with EAGAIN, matching cgroup v2's pids.max behavior. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@lifehacknexus** · 6 upvotes > _Great breakdown, thanks for sharing_ **@sinarezaei** · 3 upvotes > One detail worth highlighting: `pids.max` doesn't really mean "maximum number of processes". The kernel counts tasks (TIDs), including individual threads. > > Think about a Java service under heavy load where a thread-per-request executor starts creating native threads faster than they're being released. You could have just a handful of processes, yet still hit the cgroup PID limit. At that point, `clone()` starts returning `EAGAIN`, and suddenly the application can't create new worker threads even though CPU and memory usage might look perfectly healthy. > > That's an interesting failure mode... ## Similar posts on daily.dev - [Docker is weird](https://daily.dev/posts/docker-is-weird-s2djwoxc5) · Hacker News · 9 upvotes · 1 comments - [EP221: How Docker Works Under the Hood](https://daily.dev/posts/ep221-how-docker-works-under-the-hood-iajqja6ba) · ByteByteGo · 23 upvotes · 3 comments - [Docker's secret ingredient came from a 1992 operating system that almost nobody used](https://daily.dev/posts/docker-s-secret-ingredient-came-from-a-1992-operating-system-that-almost-nobody-used-4x9cjopcm) · XDA Developers · 2 upvotes · 0 comments --- Tags: [#devops](https://daily.dev/tags/devops), [#linux](https://daily.dev/tags/linux), [#docker](https://daily.dev/tags/docker), [#containers](https://daily.dev/tags/containers) [View this post on daily.dev](https://daily.dev/posts/gsemtnpu7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/gsemtnpu7","headline":"How Docker Works Under the Hood: Watch Namespaces Isolate a Container and cgroups Stop a Fork Bomb","text":"Shared: How Docker Works Under the Hood: Watch Namespaces Isolate a Container and cgroups Stop a Fork Bomb","url":"https://daily.dev/posts/gsemtnpu7","datePublished":"2026-10-15T09:10:09.631Z","dateModified":"2026-10-15T09:11:20.236Z","author":{"@type":"Person","name":"Bobby Iliev","url":"https://daily.dev/bobbyiliev","image":"https://avatars3.githubusercontent.com/u/21223421?v=4","description":"DevOps, DevEx, cloud \u0026 open source\n","worksFor":{"@type":"Organization","name":"Materialize","logo":"https://res.cloudinary.com/daily-now/image/upload/s--4mL2CrlK--/f_auto/v1725263959/companies/materialize"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":93020}},"image":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":85},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":4}],"sharedContent":{"@type":"WebPage","url":"https://api.daily.dev/r/AIVBYuwTW"},"comment":[{"@type":"Comment","text":"Great breakdown, thanks for sharing","datePublished":"2026-10-17T14:36:47.689Z","url":"https://daily.dev/posts/GSemtNpu7#c-WSBal3UWB","author":{"@type":"Person","name":"LifeHack Nexus","url":"https://daily.dev/lifehacknexus","image":"https://media.daily.dev/image/upload/s--ZXIKPCd6--/f_auto,pg_1/v1792330231/avatars/avatar_LDS0FrsDZBFOfUVsLqtFw?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":6}},{"@type":"Comment","text":"One detail worth highlighting: pids.max doesn’t really mean “maximum number of processes”. The kernel counts tasks (TIDs), including individual threads.\nThink about a Java service under heavy load where a thread-per-request executor starts creating native threads faster than they’re being released. You could have just a handful of processes, yet still hit the cgroup PID limit. At that point, clone() starts returning EAGAIN, and suddenly the application can’t create new worker threads even though CPU and memory usage might look perfectly healthy.\nThat’s an interesting failure mode because it can look like an application-level concurrency issue when the actual constraint is down at the kernel level. Monitoring pids.current alongside pids.events can make that distinction much easier to spot.\nThe namespace vs. cgroup distinction is probably the most important takeaway here: one controls what a process can see, the other controls what it can consume.","datePublished":"2026-10-29T23:33:00.080Z","url":"https://daily.dev/posts/GSemtNpu7#c-YQdUzKUCv","author":{"@type":"Person","name":"Sina Rezaei","url":"https://daily.dev/sinarezaei","image":"https://lh3.googleusercontent.com/a/ACg8ocLXjJ5mCeyMCQK6CSjPfPxZisLuVwj3KOgnAtXoJoPAAsuvSrxh=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/9adj6fgmy","name":"Bobby Iliev"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Bobby Iliev","item":"https://daily.dev/sources/9adj6fgmy"},{"@type":"ListItem","position":3,"name":"How Docker Works Under the Hood: Watch Namespaces Isolate a Container and cgroups Stop a Fork Bomb"}]} ```