Umut ABALI
← Back to projects

Linux Networking Lab

Notes and demos for Linux isolation and networking: namespaces, cgroups, iptables/nftables, and a light eBPF pass.

Source code

Problem

Container isolation and the packet path are easier to learn by running them. This lab packages short demos that print commands, observations, and cleanup.

Architecture

Linux Networking Lab architecture diagramHost / lab imageprivileged Ubuntu container on macOSnamespacesprocess · net · mountcgroupsCPU · mem · IOiptables / nftablesfilter · NATeBPFobservability / policy
Lab surface area from the README: namespaces, cgroups, netfilter, and eBPF behind a privileged lab image.
  • Layout: notes/ explainers, demos/ shell demos + Dockerfile, Makefile shortcuts (make demo-netns, demo-cgroup, demo-firewall, demo-ebpf, demo-all).
  • Topics: namespaces (process / net / mount), cgroups (CPU / mem / IO limits), iptables/nftables (filter and NAT), eBPF (kernel observability / policy without rewriting the kernel).
  • On macOS, demos run inside a privileged Ubuntu container because real cgroups v2, netns, nft, and eBPF need a Linux kernel. On a Linux host the same demos can run more directly.
  • Demos use docker run --privileged. Do not run on a shared prod host; tear down with docker rm -f when done.

Design decisions

Privileged container on macOS

make image / make demo-* run demos where unshare, cgroupfs, bpf, and netfilter exist.

Trade-off: Needed for kernel features on a Mac host; privileged mode must stay off shared production hosts.

Printed begin/end demos

Each demo prints === BEGIN/END === with commands, observations, and cleanup so the run is self-explaining.

Trade-off: Good for learning; not a load or security benchmark suite.

Stack

Linuxnamespacescgroupsiptables/nftableseBPFDocker

What I'd improve next

  • Deeper eBPF tracing demos tied to a specific workload.
  • Optional non-privileged paths where the host already provides the features.

Results

Demo runtime checklistBenchmark coming soon