Containers, Demystified: A New Zine from Wizard Zines

Julia Evans has released a new zine, "How Containers Work!", alongside a refreshed design for wizardzines.com. The zine is available for $12 as a printable or readable PDF, or as part of a bundle of all eight zines.

Why Container Fundamentals Matter

After years of hands-on work running containers in production, Evans notes that containers remain conceptually tricky. They aren't a single feature, but the result of combining several Linux kernel mechanisms—cgroups, namespaces, pivot_root, and seccomp-bpf—that were mostly designed to interoperate, yet still produce surprising edge cases.

The zine focuses on the fundamentals: what actually happens on a server when a container runs. Evans argues that a clear mental model of these underlying kernel features makes debugging unpredictable container behavior in production far more manageable.

Containers Are Not Magic

One of the zine's key illustrations demonstrates running a fish container image with just 15 lines of bash, inspired by the bocker project, which approximates Docker in roughly 100 lines of bash. This serves as a practical reminder that container tooling builds on well-understood Unix primitives.

The simplification highlights what a basic script omits compared to full Docker behavior:

  • No capabilities are dropped, meaning the container runs as root with full privileges, albeit in a separate mount and PID namespace.
  • No system calls are blocked via seccomp-bpf.

Tooling for Container Inspection

The zine also surveys command-line tools and files for inspecting running containers and experimenting with Linux container features:

  • mount -t overlay – create and inspect overlay filesystems.
  • unshare – create new namespaces.
  • nsenter – enter an existing namespace.
  • getpcaps – view a process's capabilities.
  • capsh – drop or add capabilities.
  • cgcreate – create a cgroup.
  • cgexec – run a command in a cgroup.
  • chroot – change the root directory (not what containers use, but educational).
  • /sys/fs/cgroups – inspect cgroup data, such as memory.usage_in_bytes.
  • /proc/PID/ns – list a process's namespaces.
  • lsns – another way to view namespaces.

Runtime-Agnostic Approach

While the zine references Docker occasionally due to its prevalence, it remains intentionally runtime-agnostic. The focus is squarely on the Linux kernel features that underpin all container systems—Docker, LXC, systemd-nspawn, Kubernetes, or otherwise—so readers can apply the knowledge broadly.

A Site Redesign

Alongside the zine release, wizardzines.com received a visual overhaul by designer Melody Starling. Beyond improving organization and navigation, the redesign adds per-zine FAQ boxes on landing pages, providing a dedicated spot to address common reader questions. The new design also features a playful touch, as the zines animate with a jump on hover.

What's Next

Evans points to two potential follow-up projects: a debugging zine started last summer but not yet finished, and a slowly growing flashcards project which could offer a new way to explain foundational concepts. The new containers zine is available now at its dedicated page on wizardzines.com.