Docker & Linux Container Internals: Namespaces, cgroups v2, Multi-Stage Builds, Rootless Containers, and Minimal Distroless Images in 2026

📌 Article Executive Takeaways

Containers are Isolated Processes: Containers are standard Linux processes isolated via kernel namespaces and resource-constrained by cgroups v2.
OverlayFS Optimization: Multi-stage builds discard build-time compilers and reduce final production image sizes by up to 95%.
Rootless Execution: Running containers in rootless mode prevents container escape exploits from gaining root access to the underlying host.

1. The Linux Kernel Foundations: Namespaces & cgroups v2

Namespaces provide process isolation (PID, Mount, Net, IPC, UTS, User) while cgroups v2 enforce CPU and memory resource quotas.

2. Storage Internals: OverlayFS & Copy-on-Write

OverlayFS unions multiple read-only lower directories with a single writable upper directory, copying files to the upper layer only when modified.

3. High-Efficiency Multi-Stage Dockerfiles

# Build Stage
FROM node:22-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --prefer-offline
COPY . .
RUN npm run build && npm prune --production

# Runtime Stage
FROM gcr.io/distroless/nodejs22-debian12:nonroot
WORKDIR /app
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/dist ./dist
USER nonroot:nonroot
EXPOSE 3000
CMD ["dist/server.js"]

4. Rootless Containers & User Namespace Mapping

Rootless container engines map root inside the container (UID 0) to an unprivileged non-root user ID on the host OS.

5. Zero-Vulnerability Minimal Images: Scratch & Distroless

Distroless images contain only your compiled application and runtime dependencies, stripping package managers, shells, and system binaries to eliminate CVE attack surfaces.

6. Container Networking: veth Pairs & Bridge Networks

Docker creates virtual ethernet pairs (veth) connecting the container's private network namespace to the host's docker0 bridge.

7. Multi-Language Dockerfile Linters

# Python 3.12: Basic Dockerfile Security Linter
def lint_dockerfile(content: str):
    issues = []
    if "USER root" in content or "USER" not in content:
        issues.append("Container running as root; specify non-root USER.")
    if ":latest" in content:
        issues.append("Avoid ':latest' image tags; use immutable SHA digests.")
    return issues

8. Container Image Size Matrix

Base Image	Uncompressed Size	Vulnerabilities (Typical)	Startup Latency
Distroless Node.js	120 MB	0 CVEs	45 ms
Node Alpine	180 MB	1 - 3 Low CVEs	65 ms
Node Debian Full	1,100 MB	40+ CVEs	350 ms

9. Production Container Hardening Checklist

✅ Enforce USER nonroot in all production Dockerfiles.
✅ Set explicit memory limits (--memory=512m) to prevent host OOM killer crashes.

10. Authoritative OCI References

Open Container Initiative Specifications

11. Frequently Asked Questions (FAQ)

What is the difference between ENTRYPOINT and CMD?

ENTRYPOINT sets the default executable invoked when the container starts, while CMD provides default arguments that can be overridden at runtime.

12. The Future of Sandboxing: MicroVMs and WebAssembly OCI

Running WebAssembly modules directly via containerd runtimes (WasmEdge, Wasmtime) allows microservices to cold-start in sub-millisecond times with memory footprints under 5 megabytes.