lucavallin/barco
FreeLinux containers from scratch in C.
FreeFree tier
About lucavallin/barco
barco is an educational project written in C that implements Linux containers from scratch. It leverages core Linux kernel features such as namespaces (including PID, network, and user namespaces), seccomp for restricting system calls, capabilities to limit root privileges, and cgroups for resource control (memory, CPU, processes). The tool can run /bin/sh in an isolated environment with root privileges, demonstrating how containers work under the hood. The project includes detailed logging, supports command-line arguments for configuration, and is built with LLVM-18 tools with debugging support via Valgrind. It is intended for learning and experimentation rather than production use.
Key Features
Implements Linux containers using kernel namespaces (PID, network, user)
Restricts system calls via seccomp filters
Limits root capabilities through libcap
Controls resource usage with cgroups (memory, CPU, processes)
Runs /bin/sh in an isolated container environment
Command-line interface with verbose logging and configuration flags
Pros & Cons
Pros
- Hands-on educational resource for understanding containers
- Directly uses real Linux kernel features without abstractions
- Open source with a clean codebase and comprehensive logging
- Supports debugging and memory leak checking with Valgrind
- Simple build process with Makefile and dependency setup script
Cons
- Not production-ready; intended for learning only
- Requires root privileges to run
- Limited functionality (only runs /bin/sh from root directory)
- Depends on non-standard libraries (libseccomp, libcap, argtable)
- No networking or storage isolation beyond namespaces
Best For
Learning Linux container internals and kernel featuresEducational demonstrations of containerizationExperimentation with namespaces, cgroups, and seccompStudying low-level Linux system programming in C
FAQ
What is barco?
barco is an educational project written in C that implements Linux containers from scratch, using kernel features like namespaces, seccomp, capabilities, and cgroups. It was created to learn about Linux containers and the Linux kernel.
How do I use barco?
Build the project using 'make' (after installing dependencies), then run the barco binary with sudo. For example: 'sudo ./bin/barco -u 0 -m / -c /bin/sh -a .' to start a container running /bin/sh as root. Add '-v' for verbose output.
What dependencies does barco require?
barco depends on libseccomp, libcap, libcunit (for testing), argtable, and rxi/log.c. It also requires LLVM-18-based tools for development and Valgrind for memory checking.