Run the image with your runtime
Assemble image building, namespace isolation, resource policy, and privilege reduction.
Jump to code and terminal ↓The pieces have contracts
The supplied builder and run-child helper contain completed components from earlier stages. Read them in /course. The child helper mounts a private writable overlay, procfs and sysfs, brings up isolated loopback, enters its cgroup, and applies image metadata and the privilege policy.
The launcher owns the boundaries
Before calling that helper, your launcher must create mount, UTS, PID, and network namespaces and fork into the PID namespace. Configure the same 20% CPU, 16 MiB memory, and eight-task budget from the resource lesson. The image command must not be able to alter these limits: its cgroup view is mounted read-only before capabilities are dropped.
Your change
Complete the two TODOs in minicontainer.sh. Use build CONTEXT IMAGE to create an image, then run IMAGE to execute it. Test builds a fresh image and checks real kernel state from a compiled probe inside it. This final network policy intentionally gives the image loopback only; the earlier veth stage shows how a runtime can opt into a controlled link.
sh /work/minicontainer.sh build /course/final-context /tmp/my-image sh /work/minicontainer.sh run /tmp/my-image
Your goal
Finish minicontainer run so the built image starts as PID 1 with private kernel views, a writable layer, resource limits, and restricted privileges.
What the tests observe
- Built image launches as PID 1
- Four private namespaces
- Writable OverlayFS root
- Enforced cgroup task budget
- Privilege policy survives exec
Need a nudge?
Hint 1
The child helper requires unshare -m -u -p -n -f sh /course/run-child.sh …
Hint 2
Configure cpu.max, memory.max, and pids.max on the newly created group before the unshare command.
Hint 3
Use the existing cleanup trap. A child failure must remain a nonzero runtime exit, while temporary resources are removed.
What happens inside Linux
You have assembled a small runtime from the same classes of kernel primitives used by larger container systems. It builds an intentionally limited image format and runs one command under explicit filesystem, namespace, resource, and privilege policies. It remains an educational rootful runtime: robust signal forwarding, adversarial path handling, user namespaces, image verification, and a production syscall policy require further engineering.
Optional account sync. Exercises work without an account.