Containers power modern infrastructure, yet very few developers understand how they actually work. Tools like Docker and Kubernetes hide a fascinating set of Linux primitives beneath a polished interface.

In this hands-on workshop we will build a minimal container runtime in Go from scratch. Participants will implement the core building blocks that make containers possible using Linux namespaces, cgroups, filesystem isolation, and process control.

Starting from a simple Go program that spawns a process, we will gradually evolve it into a lightweight container runtime capable of launching isolated workloads.

* Along the way we will explore:
* Process isolation using Linux namespaces
* Resource limits with cgroups
* Filesystem isolation using pivot_root
* Building a minimal container image
* Networking with veth pairs and bridges
* Debugging containers with standard Linux tools

By the end of the workshop participants will have a working container runtime written in Go and a much deeper understanding of how Docker and Kubernetes work under the hood.