Course Advanced

Kernel Interfaces and Isolation

Published August 16, 2026 Updated August 17, 2026

By the end of this course

Counts the facts left exposed by the isolation built from namespaces and control groups
Examines a program's behavior at the system call level and measures its cost
Shows with measurement how a container runtime rests on kernel parts

Start course

Isolation Mechanisms

Process, mount, network, user, and machine namespaces, cgroups, privileges, mandatory access control, and how they come together in a container runtime.

01 Namespaces A process's 24 observable facts spread across nine axes; five namespaces close nine of them, leave 15 open, and can fully close only two of the nine axes.
02 Control Groups The cgroup closes three of the resource axis's four facts and leaves the CPU count open; in the six-mechanism bundle the visible fact count drops from 15 to 12, and the open axis count still stands at 7.
03 Capabilities Superuser privilege is divided into separately grantable pieces; capability dropping closes only one of two facts and file permissions stay open, and in the seven-mechanism bundle the visible fact count drops to 11.
04 Mandatory Access Control Policy-based control closes one of the label axis's two facts and leaves the access label open; of 36 access pairs, 8 are required, while a coarse policy leaves 10 excess permissions and a narrow policy leaves 1.
05 Container Runtime The common six-mechanism bundle leaves 12 facts, the strict eight-mechanism bundle leaves 10: adding two mechanisms narrows the surface by only 2 facts, and the open axis count stands at 7 after the fourth mechanism.

Observation and Debugging

System call tracing, sampling-based profiling, in-kernel tracing, and core dump analysis; the fact each channel brings back and the cost it charges.

01 System Call Tracing The first measure of observation piercing isolation: of the 14 facts the strict bundle closes, 2 return through system call tracing, the open surface climbs from 10 to 12, and the run slows by 34 percent; three of the five facts the channel shows were already visible.
02 Performance Profiling The cheapest of the channels that cost anything during the run and the narrowest of the four: the sampling-based CPU profile brings back only 1 of the 14 facts the strict bundle closes, the open surface becomes 11, and the run slows by 3 percent; the returned fact does not change when the sample count grows a thousandfold.
03 In-Kernel Tracing Measuring event-based in-kernel tracing: 3 facts return for a 6-percent cost, the open surface becomes 13, and the axis the network namespace closes fully reopens, taking open axes from 7 to 8; at 2.00 points per fact, it is the lowest of the channels that cost anything during the run.
04 Core Dump Analysis Measuring the channel whose run cost is zero: a core dump brings back 3 of the 14 facts the strict bundle closes, the open surface becomes 13, and all four channels together bring back 8 facts, taking the return ratio to 0.5714; the dump's cost sits not in the run but in the sensitive data it carries.

Final exam

Kernel Interfaces and Isolation — Final Exam

questions: 45
time: 90 min
passing score: 80

45 questions from the course's 9 lessons; questions come one at a time and the clock is kept by the server.

Start the exam You need to sign in to take the exam.