Docker Is Weird

Building a custom container runtime revealed several counterintuitive aspects of Docker: containers are simply processes with kernel restrictions rather than isolated entities, and Docker images are just directories that get chroot'd into place. The implementation faces significant technical challenges, including Docker's reliance on root privileges for kernel APIs, Go's unsuitability as a language for container runtimes due to its multi-threading design and lack of native fork support, and the need to reimplement networking stacks entirely for rootless containers.