[Autogenerated] what about the registry we mentioned that there is
some registry direction that is supposed to occur.
How can we see that in some way.
So first let's try to launch the normal registry editor.
Just launch it.
And unfortunately in the registry editor you won't find
anything related to Windows containers of silos.
And the reason for that is that the registry editor shows the standard
registry which is kind of an abstraction over the real registry.
The real registry has more components and more keys than are
actually shown in the registry editor.
And so reg edit is not just not good enough to show show that.
So my own tool, total registry does provide this kind of view.
So if you go to total registry and open that up and you can find
this tool in one of my GitHub repositories.
And also of course in the downloads of this for this module and you
can see that there are two registries here really.
One of them is called the standard registry.
That's the same view you see in reg edit but there's also a
different view here called simply registry.
This is the real registry.
Some parts are easily map a ble from the real registry to the obstruction
provided by the standard registry such as registry machine which is the same
thing as h key local machine in the standard registry.
However,
some things are not really makable and some things just don't exist
in the real register in the standard registry.
In terms of Windows containers, we have this key here called W.
C.
And this means Windows containers, You can see various goods here that are used.
And this is exactly those pieces that are used for containers here as we can
confine the staff that is based on what containers see.
And this particular view,
this particular key is not reflected anywhere in the standard registry.
So here's a simple example of what happens when I for example,
destroy a container.
We know that when the container goes away,
it shouldn't leave any kind of residue on the system.
So let's grab one of these containers.
Here's one.
Let me just use exit here to to remove the container to go back to my host.
The container is now dead.
The session should be completely destroyed.
If I press F5 to refresh,
you can see that some parts of that Windows containers has gone away.
If I go ahead and kill the other container that I
have that will go away as well.
So here's uh maybe the the other container here.
Let me just go ahead and exit that as well.
And you'll see if I press a five again,
we have one less container here and so on.
If you have even more containers,
we can remove them eventually and they will all go away.
So this part is about containers that are in the registry and this is
where things are being redirected to now besides that,
we can look at containers using other tools such as the kernel debugger So
let's first go ahead and create another container here.
So let me just run the same kind of command to create a new container and
we'll find that another thing has been created here for our benefit in the
registry but it doesn't really matter at this point.
What I want to do is launch a kernel debugger So let me just
launch the local current debugger like always and we can use a
command once we connect to the local kernel called silo to show
the list of silos in the container.
So here goes some symbols have to be loaded even before we see that let's
look at another tool from Sys internals called Wino BJ.
Now we know BJ is a tool that we haven't looked at in detail just yet,
but it's about showing us the objects that are named and exist in
the system and we'll talk about in the future,
of course in greater detail.
But what you see is that when you have containers running there's a
separate object namespace under these silos directory here.
This is a directory, not in the five system but directory in memory.
This is used by the object manager to manage object that have names and
you can see there's a number here in this case 10 20.
This is known as an object IDE and this is very similar to a process.
I did the way to distinguish jobs in a in an absolute way from one another so
that we can have multiple silo keys here perhaps as needed.
If I open task manager,
we can go ahead and add this column here in task
manager called job object IDE here it is.
And you can see that for our current container here.
10 20 is in in fact the same object object I did.
That applies to this session where this container is running,
so that's exactly what we see here.
And this allows the executive, the object manager here to have a private object.
namespace for all the named objects that are stored here
in this base named objects directory.
So these are all the named objects created from that particular silo,
that particular container.
The no normal sessions are stored here under the host and you don't see
them normally because we have to run this with privileges.
Let's do that under sessions.
You can see the normal sessions used by the host and have their
own named objects which don't mix with the object that are shown
here as part of this particular silo.
And of course if you create more silos,
more containers will have more of these directories popping up.
Going back to the current debugger we can use this silo command.
So the silo command shows the list of silos on the system.
You can see that there are some application silos here.
One of them has to do with wind.
debug preview itself and some are just are currently in
the system that have been deleted here.
You can see they have zero processes.
So these are applications silos and we don't care about them
too much but we do care about server silos.
These are the real containers, you can also see him parenthesis.
The 10 20 value here, which is the job object I.
D.
You also see some good here,
which is the one that's being used in the registry W C keys to
store information for this particular silo.
If I click this address here,
the silo command is executed again and this time with a more specific
address of a silo object of several presentation here.
And you can see there's a job object here because obviously a silo is first
and foremost a job and you can see that it's a service.
Salon has 15 processes.
There's some more details here about silos,
such as the root directory in the object manager,
namespace and some something else called the silo Global's which is
just some internal information that is not really documented and
mostly used by a Microsoft for debugging silos.
But if we click these 15 value here,
it actu shows the list of processes within the silo which in fact is
the same thing as the list of processes in the job.
So it's actually running the job command we've seen in the previous
module with the value to that is the value might recall that is used
as the flag to ask the job command to list the set of processes in the
in the silo in the job really.
Which is the same thing you can see here,
there's a flag here called silo indicating that this is in fact a silo,
not just a simple job, so you can see the entire set of processes in that job,
which is close to the 18 processes we've seen and that's
because the actual product list application wasn't really
listed now because not running right now,
it was one of the processes running at the time and also S M S s and And uh
another process there which is the sound of the agent within the containers
doesn't really count as a process within the containers.
That that's why we have only 15 processes.
The season process doesn't count either.
And so in general,
that's how you you see the contents of the container using a
kernel debugger using the silo command.
And now we have a fully blown containing implementation provided by Windows,
containers.
And Docker here is just a management application that knows how to to set up
the configuration by using internal APIs targeting the kernel which are not
really documented properly but you might find more information about them by
browsing the Docker source code, some of it is available online.
So these are containers you can run applications within containers.
They are completely isolated from one another and isolated
from everything that you find on the host.