Q:

Is it possible that a docker-container brings down a whole system?

I hope my question isn't to abstract. I'm kind of stuck during troubleshooting my docker enviroment. I've got an docker-enviroment on a single Raspberry Pi containing 7 containers managed by a compose file.
 Now I've got an fairly simple question, is it possible for a single container to bring down the whole system, if there are some bad configured microservices in it? In my understanding it shoud only slow the whole system down but shouldnt cause an absolute unattainability. Also if there is something wrong the single container should shut down/restart without causing the system to fail. 
Best regards

A:

It depends on several factors:

If your container is privileged or has volumes that allows it to access the host system, it can do anything (erase files, shutdown, etc). This is usually not the case tho.
If this container manages to starve the system of resources, it'll act as a sort of DoS for the whole machine. For example if it saturates network, you might have trouble connecting to it. If it saturates CPU, the whole machine might be very slow. If it saturates RAM, you'll start to swap and it'll be very slow.

Also if there is something wrong the single container should shut down/restart without causing the system to fail.

Well, a container using 100% CPU, all RAM and all the network resources is not doing anything wrong, so it won't shutdown/restart. If it takes more memory than the RAM + swap it'll get killed eventually but before that the system will be on its knees already.
That said, what you describe as "absolute unattainability" looks weird. Given that happens on a Raspberry PI, my guess is that your container simply takes all the RAM and it starts to swap, and there's so much I/O happening on that SD card that the whole system becomes unusable.
Add some monitoring before running your container, that monitors:

CPU 
RAM
IO (especially IO wait)

Then trigger the problem, then look at the logs.
To monitor io, use something like iostat (see https://bencane.com/2012/08/06/troubleshooting-high-io-wait-in-linux) and for the RAM use free, etc. Simply write their values every X seconds to a logfile.
Once you know what the problem is, figure out why the container does that. It'd help a lot if you could tell us more about your containers (e.g show us the docker-compose file), and the hardware limits of your Raspberry Pi (is it a Pi 3? 4?). Is your SD card a fast one?

