Mini-LVE

A lightweight, custom OS-level container engine written in C++. It spawns processes into their own PID and mount namespaces, enforces memory/CPU limits via cgroups and reports live resource usage back to the CLI. The project was made mainly for the purpose of teaching myself important OS concepts and how other fully-fledged container engines work.

Architecture

• slved: background daemon (systemd service). Listens for commands over a unix domain socket, spawns and isolates containers, enforces resource limits and reaps exited processes.
• slvectl: CLI client. Sends start/stop/status commands to the daemon over the socket mentioned above.
• Isolation: clone() with CLONE_NEWPID | CLONE_NEWNS, a private mount namespace with pivot_root, a fresh /proc and minimal /dev, and a read-only rootfs.
• Resource limits: cgroups v2 (memory.max, cpu.max) applied before the container's process is ever ran.

Requirements

• Linux with cgroups v2 mounted at /sys/fs/cgroup
• CMake >= 3.16, a C++17 compiler
• systemd (for running slved as a service)

Building

git clone <repo-url>
cd mini-lve
cmake -S . -B build
cmake --build build

Installing & running

sudo ./scripts/setup.sh
sudo systemctl start slved

Usage

# Launch a container
sudo slvectl start -n myapp -m 128 -c 50 -p /bin/echo -a "hello"

# Check running containers' live memory/CPU usage
sudo slvectl status

# Stop a container (SIGTERM, escalates to SIGKILL after a grace period)
sudo slvectl stop -n myapp

Run slvectl with no arguments for full flag documentation.

Testing

A quick test that confirms the memory limit is actually enforced by launching a resource hogging process:

sudo systemctl start slved
sudo ./scripts/memlimit_test.sh

Project structure

CMakeLists.txt
include/
  protocol.hpp
  manager.hpp
scripts/
  setup.sh
  slved.service
  mem_hog.cpp
  memlimit_test.sh
src/
  client/             # slvectl
  common/             # socket_utils
  daemon/             # slved, CgroupManager