Principles of a Daemonless Runtime: Why Cardinal Requires No Background Service
Why a daemonless runtime is superior for lean container workloads: direct clone(2) execution, cgroups v2 resource accounting, OverlayFS, and zero idle memory footprint.
- ▸Traditional runtimes consume host memory on persistent root daemon daemons (dockerd / containerd).
- ▸Cardinal configures namespaces, mounts OverlayFS, binds cgroups v2 controllers, and cleanly exits.
- ▸Containers continue execution under the supervision of the Linux kernel directly.
- ▸Dynamic port assignment (`cardinal port add/rm`) modifies nftables/iptables without container restarts.
1. The Overhead of Persistent Runtime Daemons
In classical container systems like Docker or containerd, a persistent background daemon consumes 50-150 MB of resident RAM even when idle. Daemon crashes endanger state tracking and active workloads. Cardinal was engineered from first principles around a daemonless philosophy: a static ~5 MB binary runs only when executing, stopping, or inspecting containers.
2. Linux Primitives: clone(2) & cgroups v2
Linux containers are standard processes isolated via kernel namespaces. Cardinal invokes clone(2) with CLONE_NEWPID, CLONE_NEWNS, CLONE_NEWNET, CLONE_NEWUTS, and CLONE_NEWIPC flags. Resource constraints (CPU quotas, memory.max, and I/O weights) are enforced directly through native cgroups v2 controllers (`/sys/fs/cgroup/cardinal/<id>`).
# Запуск PostgreSQL с лимитом 1 ГБ RAM и 2 ядрами CPU
cardinal run -d --name pg-main \
--memory 1024m \
--cpus 2 \
-p 5432:5432 \
postgres:16
# Проверка реального потребления ресурсов через cgroups v2:
cardinal stats pg-main3. Dynamic Port Forwarding Without Restarts
A distinct feature of Cardinal is dynamic port forwarding on running workloads without recreation. The command `cardinal port add <container> <host_port>:<container_port>` modifies Linux network NAT tables on the fly, immediately routing incoming packets.