TL;DR: I was three hours deep into a Docker networking debug session — containers couldn't reach each other, docker network inspect was giving me nothing useful — and I had this uncomfortable realization: I was treating Docker like magic. I knew the commands.

📖 Reading time: ~41 min

What's in this article

Why I Built This (And Why You Should Too)

The Four Linux Primitives Docker is Built On

Step 1 — Isolating a Process With Namespaces

Step 2 — Building a Minimal Root Filesystem With debootstrap\

Step 3 — Pivoting the Root With chroot\ (and Why pivot\_root\ Is Better)

Step 4 — Limiting Resources With cgroups v2

Step 5 — Network Isolation With a veth Pair

Putting It All Together — A ~80 Line Shell Script That Actually Works

Why I Built This (And Why You Should Too)

I was three hours deep into a Docker networking debug session — containers couldn't reach each other, docker network inspect was giving me nothing useful — and I had this uncomfortable realization: I was treating Docker like magic.…