BantuBox

Containers are usually explained with a diagram and the word “lightweight.” That explanation survives exactly until someone asks what actually isolates a process. BantuBox was me answering that question by building one.

It is not a Docker clone and does not try to be. It is a working model that runs Linux containers and makes the underlying mechanisms visible: process isolation, filesystem mounting and management inside the container, and container lifecycle handling.

The interesting problem

The isolation itself comes from the kernel: namespaces for process, mount, and network separation, plus cgroups for resource control. Python can reach some of that, but not all of it. The os module simply does not expose the system calls this needs.

So the project includes wrappers written in C, compiled as a CPython extension module and imported back into the Python side. That is the part worth showing. It meant working directly against the kernel interface rather than against a library that had already made the decisions, building the extension with setup.py, producing a wheel, and installing it into the environment the runtime runs in.

Why it still belongs here

This was 2023 work, and it is the earliest thing on this site. I keep it because it is the honest answer to what the foundation looks like: not a tutorial app, but a container runtime assembled from namespaces, cgroups, and syscalls, in two languages, because one language could not reach far enough.