Topic domain
Virtualization
Multiplexing hardware and isolating workloads.
- Articles
- 80
- Clusters
- 8
- Foundational
- 24
- Intermediate
- 32
- Advanced
- 24
Hypervisors
10Trap-and-emulate, paravirtualization, and hardware assist.
- Trap-and-Emulate: The Popek-Goldberg Conditions and Sensitive Instructions
- Ring Compression: Deprivileging a Guest Kernel Without Losing Its Own Protection
- Shadow Page Tables: Keeping Two Guest Mappings Consistent With One Hardware Walk
- Inside the VMCS: What Hardware Virtualization Actually Saves and Restores
- Second-Level Address Translation: Composing Two Page Walks in Hardware
- Paravirtualization and the Hypercall ABI: Trading Transparency for Fewer Traps
Containers
10Images, layers, and runtime isolation.
- From Image Manifest to Mounted Root Filesystem
- Content Addressing: Why a Layer Is Named by Its Digest
- Copy-Up, Whiteouts and Rename in Overlay Roots
- How Seven Namespaces Compose Into a Container
- Standard I/O, Terminal Allocation and Exit Status Propagation
- Memory and CPU Limits Under the cgroup v2 Unified Hierarchy
Scheduling, reconciliation, and rollout.
- The Reconciliation Loop and Level-Triggered Control of Declared State
- Filtering and Scoring: How a Scheduler Picks One Node Out of Thousands
- Resource Requests, Limits, and What the Scheduler Actually Counts
- Placement Constraints and the Anatomy of an Unschedulable Workload
- Rolling Updates, Surge, and the Arithmetic of Availability
- Heartbeats, Leases, and the Timeout That Declares a Node Dead
Exit costs, I/O paths, and overcommit.
- Anatomy of a VM Exit: State Save, Exit Qualification, and Where the Cycles Go
- Nested Paging: The Two-Dimensional Walk and the Cost of a Single Guest Access
- Emulated MMIO: Instruction Decode, Register Semantics, and Exit Storms
- Virtualizing the Local APIC: Access Pages, Virtual Interrupt Delivery, and Posted Interrupts
- The Virtio Split Ring: Descriptor Chaining and the Two Suppression Flags
- Counting Copies on the Virtual I/O Path: Userspace, vhost, and Passthrough
State transfer and downtime bounds.
- The Stop-and-Copy Boundary in Live Migration
- Dirty Page Rate and the Convergence Condition
- Hardware Dirty-Bit Tracking for Guest Memory
- Encoding Guest Memory for the Migration Stream
- Serializing Device State Across a Migration
- Network Path Continuity Across a Migration
Sandboxing
10Syscall filtering and kernel isolation.
- What a Seccomp Filter Can See of a Syscall
- Action Precedence When Seccomp Filters Stack
- Why a Seccomp Filter Cannot Inspect Syscall Arguments in Memory
- What a Namespace Isolates and What It Leaves Shared
- How Capability Sets Split Root Authority
- Landlock Rulesets: Path Hierarchies and Access Masks
Build provenance and registry trust.
- Content Digests and Why an Image Tag Is Not an Identity
- How an OCI Manifest and Index Name Their Layers
- The Registry Pull Path From Manifest to Blob
- Layer Cache Keys and What Makes a Build Reproducible
- What an Image Signature Covers and What It Leaves Out
- Provenance Statements and the Subject Digest
Internal platforms and golden paths.
- What a Golden Path Guarantees: The Platform Contract as a Versioned Interface
- Tenant Isolation in an Internal Platform: Which Boundary Does the Work
- Reconciliation Loops: Why Level-Triggered Control Beats Event Handling
- Admission Control as the Enforcement Point for a Golden Path
- Propagating Template Changes Across an Instantiated Fleet
- Quota Arithmetic: Why a Shared Pool Cannot Promise Every Tenant Its Share
All Virtualization articles
- Oct 9, 2026 Abort Paths and the Blackout Window A migration can fail at any point, and what the guest experiences depends on which side still holds a complete state. The ordering of commit, acknowledgement, and source teardown defines what rollback is possible.
- Sep 28, 2026 Resource Requests, Limits, and What the Scheduler Actually Counts Why a request is a scheduling reservation rather than a runtime guarantee, how limits are enforced by cgroups, and why the two numbers produce three quality-of-service classes.
- Sep 26, 2026 The Shared Kernel Boundary and What Containers Cannot Isolate Why container isolation is a partition of kernel state rather than a hardware boundary, which attack surfaces remain, and how the layers of defence are composed.
- Sep 25, 2026 Cluster Segmentation: Choosing a Blast Radius Instead of Accepting One Control plane failure, node failure, and tenant misbehaviour propagate differently. How to decide what shares a cluster, what must be separated, and what separation costs in operational surface.
- Sep 11, 2026 Post-Copy Migration and Demand Paging from the Source Instead of shrinking the dirty set, post-copy moves the vCPUs first and faults memory back from the source on demand. It bounds downtime at the cost of fault latency and a source that cannot be released.
- Sep 8, 2026 Virtualized Performance Counters and the Time They Do Not Count How a guest gets access to a PMU, what context switching the counters costs, and why the cycles reported inside a guest systematically omit the time the hypervisor spent on its behalf.
- Sep 3, 2026 Content Digests and Why an Image Tag Is Not an Identity How a digest names image bytes rather than a name, what the verification chain from tag to unpacked filesystem actually checks, and where that chain is weaker than it looks.
- Aug 27, 2026 Storage Handoff: Moving a Guest's Disk With It Block devices cannot be frozen and copied like RAM. Either the disk stays put and is re-attached, or its contents move while the guest writes, and each option has a different consistency failure.
- Aug 7, 2026 Anatomy of a VM Exit: State Save, Exit Qualification, and Where the Cycles Go What the processor writes to the VMCS on every exit, which exit reasons dominate a running guest, and why the host-side handler usually costs more than the transition itself.
- Jul 29, 2026 Supervising Syscalls with Seccomp User Notification How a filter can suspend a syscall and hand the decision to another process, what the notification structure carries, and why descriptor injection avoids the race that memory inspection cannot.
- Jul 23, 2026 Placement Constraints and the Anatomy of an Unschedulable Workload How taints, tolerations, affinity, and topology spread interact so that a workload can be legal on every node individually and still fit nowhere, and how preemption resolves it.
- Jul 23, 2026 Ring Compression: Deprivileging a Guest Kernel Without Losing Its Own Protection How a hypervisor moves a guest kernel down the x86 privilege ladder, why the choice between ring 1 and ring 3 changes what the guest can enforce against its own processes, and which instructions leak the difference.
- Jul 23, 2026 Virtualizing the Local APIC: Access Pages, Virtual Interrupt Delivery, and Posted Interrupts Why every interrupt acknowledgement used to cost an exit, how hardware removed the exit for the common case, and what a posted interrupt descriptor does between the device and the guest.
- Jun 22, 2026 Dirty Page Rate and the Convergence Condition Pre-copy migration only terminates when the guest dirties memory slower than the link can carry it. The ratio of those two rates decides the pass count, the total data moved, and whether the migration finishes at all.
- Jun 21, 2026 Propagating Template Changes Across an Instantiated Fleet Once a golden path has been copied a hundred times, a change to the template is a migration. Three propagation models, the merge conflicts each produces, and how to make a breaking template change survivable.
- May 26, 2026 Reconciliation Loops: Why Level-Triggered Control Beats Event Handling A platform that compares desired state to observed state on every pass recovers from missed events and partial failures. The mechanism, its cost in API traffic, and the edge cases where a loop oscillates.
- Apr 18, 2026 Verifying Provenance by Rebuilding What an independent rebuild proves, which nondeterministic packaging details decide whether it succeeds, and how to compare artifacts layer by layer rather than by image digest.
- Apr 16, 2026 Nested Virtualization: Running a Hypervisor Inside a Guest Why the L1 hypervisor's control structure must be virtualized by L0, how exit causes are merged across two levels, and what the recursion costs in exit latency and state tracking.
- Apr 16, 2026 Network Path Continuity Across a Migration Moving a guest changes the port its frames egress from. Switch forwarding tables, ARP caches, and in-flight TCP segments all have to be re-pointed, and the guest must not observe a reset connection.
- Apr 15, 2026 Owner References, Finalizers, and Why Deletion Is a Protocol How the API server tracks which object owns which, why a delete is a two-phase operation with an intermediate state, and what a finalizer that never completes does to a namespace.
- Apr 13, 2026 Overcommitted Guest Memory: Ballooning, Page Sharing, and Whose Reclaim Runs First How a hypervisor hands out more memory than it owns, why the guest cannot see pages being taken away, and the two mechanisms that make the guest a participant rather than a victim.
- Feb 23, 2026 Copy-Up, Whiteouts and Rename in Overlay Roots What happens on the first write to a file from a lower layer, how deletions are represented without deleting, and which POSIX behaviours overlayfs cannot preserve.
- Feb 22, 2026 Layer Cache Keys and What Makes a Build Reproducible Why two builds of the same source produce different layer digests, which inputs a build cache actually keys on, and how instruction ordering changes both reuse and image size.
- Feb 17, 2026 Steal Time and vCPU Skew: What Happens When a Guest Gets Fewer Cores Than It Asked For Why a guest cannot see its own descheduling, how paravirtualized steal accounting reports it, and why lock holders that lose the CPU cost far more than the time they lost.
- Feb 11, 2026 Trap-and-Emulate: The Popek-Goldberg Conditions and Sensitive Instructions Why a guest kernel running without real privilege can still appear to control the machine, which instructions break that illusion, and how the 1974 virtualization theorem decides where traps must land.
- Feb 6, 2026 Virtual Interrupts: APIC Emulation, Interrupt Remapping, and Posted Delivery How a guest programs its own interrupt controller without touching the host's, what the IOMMU must check before a device interrupt is delivered, and why posted interrupts remove the exit from the delivery path.
- Feb 1, 2026 The Virtio Split Ring: Descriptor Chaining and the Two Suppression Flags The byte layout of the descriptor table, available ring, and used ring, how descriptors chain through guest memory, and how the event-index mechanism replaces the older no-notify flags.
- Jan 7, 2026 Autoscaling as a Feedback Loop: Gain, Lag, and Why It Oscillates How a replica controller turns a metric into a desired count, why the control law is proportional rather than predictive, and how sampling lag and stabilisation windows prevent or cause oscillation.
- Dec 29, 2025 Enforcing Sandbox Policy at BPF LSM Hooks How an eBPF program attached to a kernel LSM hook can decide a security question with access to kernel objects, and why the hook it chooses determines what it can express.
- Dec 22, 2025 Paravirtualization and the Hypercall ABI: Trading Transparency for Fewer Traps How a modified guest replaces trapping instructions with explicit calls into the hypervisor, what a hypercall looks like at the instruction level, and why the ABI has to be versioned and discoverable.
- Dec 17, 2025 Registry Protocols: Blob Uploads, Ranges and Cross-Repository Mounts The HTTP API behind image distribution, including chunked upload sessions, resumable ranges, manifest validation and the mount shortcut that avoids re-uploading shared layers.
- Nov 5, 2025 Inside the VMCS: What Hardware Virtualization Actually Saves and Restores The control structure that replaced ring deprivileging, which fields decide whether a guest instruction exits, and why the exit path costs more than the instruction it intercepts.
- Sep 20, 2025 What a Golden Path Guarantees: The Platform Contract as a Versioned Interface A golden path is a contract only when it declares its inputs, the runtime facts it provides, and the platform versions it tracks. What that declaration contains, and what breaks when a piece of it is missing.
- Jul 18, 2025 Admission-Time Verification and Digest Pinning What a cluster can check between a pod specification and an image pull, why the kubelet is the wrong place for that check, and how digest pinning interacts with tag resolution order.
- Jun 26, 2025 How Seven Namespaces Compose Into a Container Each namespace type isolates a different resource table, and the order and ownership of unshare calls determine what a process can still see.
- Jun 4, 2025 Emulated MMIO: Instruction Decode, Register Semantics, and Exit Storms How a write to an emulated device register becomes a trap, what the hypervisor must decode before it can act, and why a driver that pokes registers in a loop degrades an entire host.
- May 6, 2025 Second-Level Address Translation: Composing Two Page Walks in Hardware How EPT and nested paging remove the shadow-table trap per guest page-table write, what the extra walk costs in memory references, and why accessed and dirty bits become a virtualization problem.
- Apr 24, 2025 Serializing Device State Across a Migration Emulated devices carry configuration registers, queue indices, and pending interrupts that must be reconstructed exactly on the destination. The format is versioned, and the failure mode is a guest that resumes with a device it does not recognise.
- Apr 22, 2025 Content Addressing: Why a Layer Is Named by Its Digest How digest-addressed storage makes image layers immutable, what deduplication falls out of it, and why garbage collection needs a reachability walk.
- Apr 21, 2025 The Reconciliation Loop and Level-Triggered Control of Declared State How a controller compares declared state with observed state, why every event is only a hint to re-read, and what a stale cache costs at the write.
- Mar 29, 2025 Escaping a Chroot Through Retained Directory Descriptors Why changing a process root does not confine a process that holds an open descriptor above it, how the classic escapes work, and what pivot_root and mount namespaces do differently.
- Mar 14, 2025 How an OCI Manifest and Index Name Their Layers The descriptor graph behind a single image reference, how platform selection picks one manifest out of an index, and the failure cases in the matching rules.
- Jan 14, 2025 Capability Sets and UID Mapping in Rootless Containers How a user namespace turns UID 0 into an unprivileged identity, which capabilities survive the mapping, and why setuid binaries break in ways that look like permission bugs.
- Jan 3, 2025 Nested Paging: The Two-Dimensional Walk and the Cost of a Single Guest Access How EPT and NPT turn every guest memory access into two page walks, what an EPT violation reports, and why the hardware page-walk cache decides whether nested paging is cheap or ruinous.
- Dec 30, 2024 Quota Arithmetic: Why a Shared Pool Cannot Promise Every Tenant Its Share Requests, limits, and overcommit interact through the scheduler and the cgroup hierarchy. How to compute whether a set of quotas fits a pool, and where the arithmetic stops being safe.
- Dec 26, 2024 Filtering and Scoring: How a Scheduler Picks One Node Out of Thousands The two-phase placement cycle, why feasibility is computed per node instead of per constraint, and how scoring turns a set of legal nodes into a single binding decision.
- Nov 27, 2024 From Image Manifest to Mounted Root Filesystem How a container image is assembled from a manifest, a config blob and ordered layer tarballs, and what the runtime does between pulling and exec.
- Nov 18, 2024 Leader Election, Leases, and What Quorum Protects Against Why a control plane needs a single active writer, how lease-based election bounds the overlap window, and where the underlying consensus store changes the guarantee.
- Oct 22, 2024 Checkpoint and Restore of a Running Container How a process tree is frozen, serialised to disk and reconstituted, which state can be captured exactly and which state must be re-established cooperatively.
- Sep 25, 2024 Hardware Dirty-Bit Tracking for Guest Memory How second-level page tables record which guest pages changed, why the first pass needs write protection, and what the bitmap costs in exits when the CPU cannot set the bit itself.
- Aug 10, 2024 Memory and CPU Limits Under the cgroup v2 Unified Hierarchy How memory.max, memory.high and cpu.max are enforced, why reclaim happens before the OOM killer, and what the pressure stall counters measure.
- Jul 24, 2024 What a Namespace Isolates and What It Leaves Shared The eight namespace types, the resources each one partitions, and the state that stays global no matter how many namespaces a process joins.
- Jul 20, 2024 Why a Seccomp Filter Cannot Inspect Syscall Arguments in Memory The pointer-versus-contents problem in syscall filtering, the race that makes dereferencing unsafe even if it were allowed, and the mechanisms that recover argument-aware policy without it.
- May 23, 2024 Referrers, Attachments, and the Artifact Graph How a registry indexes artifacts by the digest they describe, why the fallback naming convention is spoofable, and how a verifier discovers signatures and SBOMs without being told where to look.
- Mar 5, 2024 Tenant Isolation in an Internal Platform: Which Boundary Does the Work Namespaces, service accounts, resource quotas, and network policy each stop a different class of interference. Choosing the wrong one leaves a gap that looks like isolation but is only naming.
- Feb 22, 2024 Provenance Statements and the Subject Digest How a build attestation names the artifact it describes, what the subject field binds, and why a valid attestation is not the same as an attestation about the image being deployed.
- Dec 15, 2023 Ephemeral Preview Environments: Naming, Lifetime, and Cost Control A per-change environment needs a deterministic name, a lifecycle bound to something that can be observed, and a cost ceiling. Where each of those decisions fails, and why cleanup is the hard part.
- Dec 15, 2023 Shadow Page Tables: Keeping Two Guest Mappings Consistent With One Hardware Walk Why a hypervisor must build its own page tables from the guest's, which guest writes force a rebuild, and how the reverse-map and write-protection machinery bounds the cost of keeping them honest.
- Nov 13, 2023 Migrating Guests Whose Memory the Hypervisor Cannot Read Confidential computing encrypts guest memory under keys the hypervisor does not hold, which removes compression, zero-page detection, and inspection from the migration path and adds an attestation step at the destination.
- Oct 11, 2023 Pull-Through Caches and Where the Trust Anchor Sits How a caching proxy changes the set of parties that can influence an image, why the cache must not also serve the keys used to verify it, and what staleness does to revocation.
- Oct 6, 2023 Encoding Guest Memory for the Migration Stream Zero pages, compression, and delta encoding decide how many bytes a migration actually sends. The choice trades host CPU and per-page framing overhead against bandwidth, and each option fails on a different workload.
- Aug 23, 2023 How Capability Sets Split Root Authority The five capability sets a Linux process carries, the transitions between them at exec, and why dropping a capability is not the same as dropping a file permission.
- Aug 4, 2023 Admission Control as the Enforcement Point for a Golden Path Validating and mutating admission sit between the tenant and the stored object. How they differ, why mutation order is undefined, and what a rejection should tell the tenant.
- Jun 30, 2023 The Registry Pull Path From Manifest to Blob The HTTP exchanges a client performs to turn a reference into a local image, including token authentication, blob redirects, range requests, and where each step can fail.
- Jun 10, 2023 Counting Copies on the Virtual I/O Path: Userspace, vhost, and Passthrough How many times a packet is touched between a guest buffer and the wire in each device model, what each eliminated copy costs in complexity, and where the remaining copies cannot be removed.
- Jun 1, 2023 What a Seccomp Filter Can See of a Syscall The fixed 64-byte record a seccomp filter receives, why the architecture field decides whether the syscall numbers mean anything, and what the filter cost buys.
- May 21, 2023 What an Image Signature Covers and What It Leaves Out How a signature envelope binds a signing key to a payload digest, why the payload is usually not the image, and the payload types that close different parts of the gap.
- Jan 23, 2023 The Fabricated Machine: ACPI Tables, SMBIOS, and PCI Configuration Space How a hypervisor describes hardware that does not exist, which tables the guest kernel trusts for topology and interrupt routing, and why a wrong table entry survives every test until the guest boots on real silicon.
- Jan 13, 2023 Landlock Rulesets: Path Hierarchies and Access Masks How Landlock binds access rights to directory hierarchies instead of syscalls, how the handled-access mask determines what a ruleset can enforce, and where the model stops.
- Jan 3, 2023 The Stop-and-Copy Boundary in Live Migration Why a migrating virtual machine must freeze its vCPUs at one exact instant, what state that instant must capture, and how the residual copy sets the floor on downtime.
- Dec 16, 2022 Sunsetting a Golden Path Without Breaking the Tenants on It Retiring a path means migrating every instantiated copy. How to inventory the fleet, freeze adoption, migrate in waves, and decide when a path is retired rather than repaired.
- Dec 8, 2022 TLB Tagging and Nested Invalidation: Keeping Translations Alive Across a VM Boundary Why guest translations must survive an exit, how address-space identifiers make that possible, and why invalidating the second level is coarser and more expensive than the first.
- Oct 20, 2022 Unprivileged User Namespaces and the Attack Surface They Open Why allowing any process to create a user namespace turns privileged kernel code paths into reachable ones, which subsystems are most exposed, and how the trade is bounded in practice.
- Oct 4, 2022 Action Precedence When Seccomp Filters Stack How the kernel combines verdicts from multiple attached filters, why the winning action is chosen by a documented ranking rather than by numeric order, and how thread synchronization decides which filters exist at all.
- Sep 28, 2022 Rolling Updates, Surge, and the Arithmetic of Availability How a rolling update walks a replica set down and up without dropping below a floor, why maxSurge and maxUnavailable interact with readiness rather than with process start, and where the arithmetic breaks.
- Apr 18, 2022 Service Level Objectives for a Platform, Not for a Service A platform SLO measures whether tenants can get work done, not whether a component is up. How to define the request journey, choose indicators that tenants feel, and handle the shared-dependency problem.
- Apr 12, 2022 Canary Releases and the Statistics of Deciding to Promote How traffic is split between two versions without a shared load balancer, why the promotion decision needs a sample-size calculation, and what a canary cannot detect at any sample size.
- Apr 9, 2022 The Virtio Split Ring: Descriptor Tables, Available Rings, and the Notification Suppression How a guest and a hypervisor exchange buffers without a trap per request, what the three-ring layout enforces, and why the notification flags matter more than the data path.
- Apr 1, 2022 Standard I/O, Terminal Allocation and Exit Status Propagation How a runtime wires stdin, stdout and stderr for a container process, when a pseudo-terminal is allocated, and how the exit status travels back to the caller.
- Mar 15, 2022 Heartbeats, Leases, and the Timeout That Declares a Node Dead Why node liveness is a leased lease with a bounded renewal, how the kubelet's lease write differs from its status report, and what a false positive costs when the network partitions.