Agenda
• 30 minutes open chat
• 90 minutes interactive talk & questions
• 30 minutes open chat

Have you ever used Docker and wondered "what is actually going on?"

Containers often feel a bit mysterious - many of us use them daily without a clear understanding of what they actually are or how they work.

In this talk, we’ll demystify containers by building a minimal, rootless container in Rust in roughly 100 lines of code.

Along the way, we’ll:
・clarify what separates containers from virtual machines,
・explore how process isolation works on Linux
・understand why running containers without root privileges is a meaningful security improvement.

Using Rust and the nix crate, we’ll interact directly with Linux kernel primitives in a way that stays both low-level and readable. Rust’s compiler-enforced honesty - explicit error handling, visible unsafe boundaries, and typed system call interfaces - makes the mechanics of container isolation difficult to ignore.