Limiting container access to host resources
In this section, we will learn how to limit hosts’ resources inside containers, but first, we will take a look at the container network model and how to use volumes to override container storage.
Network isolation
Network isolation is provided by assigning a network namespace to each container; hence, virtualized IP addresses are added to containers. These assignments are provided from a pool of defined IP addresses managed by the container runtime’s internal IPAM. This is the way that internal IP addresses are assigned, but all virtual interfaces are associated by default with a bridged host interface. Each container runtime will create and manage its own bridge interface. Docker will use docker0 by default. This interface is created during Docker daemon installation and all IP containers’ interfaces will be associated with docker0. Different drivers can be used to extend this default behavior, for example, to...
