Inspiration
After building a database from scratch, I wanted to go a layer lower and find out what a container actually is — not a VM, not magic, just a handful of Linux kernel primitives wired together. The only way to really learn that is to wire them together myself, by hand, in a systems language with no safety net.
What it does
myrun is a container runtime written in Rust with zero external crates. It isolates a process using hand-rolled Linux namespaces, enforces resource limits with cgroup v2, restricts syscalls with seccomp filters, and drops Linux capabilities before handing control to the contained process. Networking is wired up directly through netlink rather than shelling out to another tool. The runtime is split across a 3-process architecture to keep the privileged setup path separate from the process that actually runs inside the container.
How I built it
Every one of those pieces — namespace setup, cgroup v2 accounting, seccomp-bpf filter construction, capability dropping, and the netlink socket work for networking — is implemented directly against the Linux syscall interface, with nothing from the crates.io ecosystem doing the heavy lifting. That constraint meant reading kernel documentation and existing runtimes' source as the spec, then reimplementing the pieces myrun actually needed.
Challenges I ran into
The hardest part wasn't getting the happy path working — it was proving the isolation actually holds under failure. I built a fault-injection harness with 19 distinct injection points (failing a specific syscall, killing a process at a specific stage of setup, and so on) exercised across 205 tests, specifically to catch the failure modes that only show up when something goes wrong partway through container setup or teardown, not when everything succeeds.
