Containers 📦
Kubernetes schedules containers; it does not explain them. This section covers the layer underneath: what a container actually is on a Linux host, how an image is put together and shipped, and what runs it.
If you can explain why a container is “just a process”, why a rebuild is sometimes instant and sometimes slow, and what happens between kubectl apply and a running process, Kubernetes becomes much easier to debug.
Reading order
- Namespaces and cgroups — A container is a process with a restricted view and a resource budget. Build one by hand.
- Images and layers — The OCI image format, content addressing, the layer cache, multi-architecture images.
- Dockerfile best practices — Small, fast, reproducible and secure builds.
- Registries — How push and pull work, tags versus digests, authentication, signing, mirroring.
- Container runtimes — Docker, containerd, runc and the CRI: who does what.
- Container networking — veth pairs, bridges, port publishing and how this becomes Kubernetes networking.
- WebAssembly — A different sandbox, and where it does and does not replace containers.
The stack at a glance
docker CLI / nerdctl / kubectl
│
dockerd kubelet
│ │ CRI (gRPC)
└────────► containerd ◄─────┘ ← pulls images, manages snapshots and lifecycles
│
containerd-shim ← one per container; survives containerd restarts
│
runc ← OCI runtime: sets up namespaces and cgroups, then exec()
│
your process (PID 1 in its own namespace)
──────────────── Linux kernel ────────────────
namespaces · cgroups · overlayfs · seccomp · capabilities
The Linux building blocks
These live in the Linux section and are worth reading alongside:
| Mechanism | What it provides | Note |
|---|---|---|
| PID namespace | A private process tree | Process namespace |
| Mount namespace | A private filesystem view | Mount namespace |
| Network namespace | Private interfaces, routes and ports | Network namespace |
| User namespace | Root inside, unprivileged outside | User namespace |
| cgroups | CPU, memory, I/O and PID limits | cgroups |
| OverlayFS | Layered copy-on-write filesystems | OverlayFS |
| Capabilities | Root’s power, split into pieces | Capabilities |
| seccomp | System call filtering | seccomp |
| AppArmor | Mandatory access control profiles | AppArmor |
Related tools and comparisons: container runtimes on Linux, Podman, systemd-nspawn, hypervisors and emulation versus virtualisation.
Security
- Container security on Linux — the isolation boundary and how it is weakened
- Image hardening
- Security context
- Runtime sandboxing — gVisor, Kata and Firecracker
- Container image scanning
- SBOMs
Where containers run
- ☸️ Pods — the Kubernetes wrapper around one or more containers; see also the pause container
- ☁️ Amazon ECS and Fargate
- 🔷 Azure compute — Container Apps and AKS
- 🟠 GCP compute — Cloud Run and GKE
Related
- Linux — the operating system all of this is built from
- CD — where images are built and promoted
- Image pull failures and CrashLoopBackOff