Virtualization · Cluster
Containers
Images, layers, and runtime isolation.
- 01 From Image Manifest to Mounted Root Filesystem How a container image is assembled from a manifest, a config blob and ordered layer tarballs, and what the runtime does between pulling and exec.
- 02 Content Addressing: Why a Layer Is Named by Its Digest How digest-addressed storage makes image layers immutable, what deduplication falls out of it, and why garbage collection needs a reachability walk.
- 03 Copy-Up, Whiteouts and Rename in Overlay Roots What happens on the first write to a file from a lower layer, how deletions are represented without deleting, and which POSIX behaviours overlayfs cannot preserve.
- 04 How Seven Namespaces Compose Into a Container Each namespace type isolates a different resource table, and the order and ownership of unshare calls determine what a process can still see.
- 05 Standard I/O, Terminal Allocation and Exit Status Propagation How a runtime wires stdin, stdout and stderr for a container process, when a pseudo-terminal is allocated, and how the exit status travels back to the caller.
- 06 Memory and CPU Limits Under the cgroup v2 Unified Hierarchy How memory.max, memory.high and cpu.max are enforced, why reclaim happens before the OOM killer, and what the pressure stall counters measure.
- 07 Capability Sets and UID Mapping in Rootless Containers How a user namespace turns UID 0 into an unprivileged identity, which capabilities survive the mapping, and why setuid binaries break in ways that look like permission bugs.
- 08 Registry Protocols: Blob Uploads, Ranges and Cross-Repository Mounts The HTTP API behind image distribution, including chunked upload sessions, resumable ranges, manifest validation and the mount shortcut that avoids re-uploading shared layers.
- 09 The Shared Kernel Boundary and What Containers Cannot Isolate Why container isolation is a partition of kernel state rather than a hardware boundary, which attack surfaces remain, and how the layers of defence are composed.
- 10 Checkpoint and Restore of a Running Container How a process tree is frozen, serialised to disk and reconstituted, which state can be captured exactly and which state must be re-established cooperatively.