Skip to content
academia.sh
tr
Log in

Course Intermediate

Containers

By the end of this course

Start course

01

Container Concept

Meeting the problem of dependency and environment difference with isolation: comparing the isolation level and cost of a physical server, a virtual machine, and a container; what each of namespaces, control groups, and the union filesystem separates; the portability promise carried by runtime and image format specifications; and the resource a container holds through the steps of creation, running, stopping, and cleanup.

  1. 01 Why Containers Whether the environment difference can be pulled into the output is counted: the previous course's 18 differences are split into three buckets, the byte cost of what gets pulled in is measured, and the share of what must stay in the environment is written down.
  2. 02 Servers, Virtual Machines, and Containers Three isolation levels are compared by the same criteria: which one separates what, duplicates what, how many megabytes of memory base and what order of magnitude of startup delay it demands in return, and how many instances fit on a single machine.
  3. 03 Underlying Technologies The three mechanisms that build container isolation are modeled separately: the namespace as a visibility mapping, the control group as a share allocator, the union filesystem as a layer stack; each one's cost and the place it is pierced are counted.
  4. 04 Container Standards The promise carried by an image format specification is split into three parts and a verifier that checks the digest chain is written; how far portability actually goes is counted: what stays the same and what changes between two runtimes that comply with the same specification.
  5. 05 Container Lifecycle Creation, running, stopping, and cleanup are built as a state machine; the resource held at every transition is counted, and the layer, network name, and volume that stopped-but-uncleaned containers accumulate over a period are measured.

02

Images

Splitting the build artifact into layers: the layer model's reuse, the image definition file's instructions and build context, the effect of instruction order on cache hit rate and build time, separating build tools from the output, the base image selection's balance of size, updatability, and attack surface, the tagging scheme for version traceability, image registries and scanning, signing, and running with least privilege.

  1. 01 Image and Layer Model An image is measured as an ordered list of layers: how many layers two services sharing a common base share, how many bytes are stored once, and what the gain is over a flat copy are counted; when a lower layer changes, how many upper layers' chain ids invalidate and how many bytes a deleted file still occupies in the store are measured.
  2. 02 Image Definition File How layers are born from instructions rather than by hand is measured: a five-instruction definition file format is defined, an interpreter that applies instructions in sequence is written, and the build context's size is counted — the files and bytes entering the tree, the share the exclusion rule cuts, and the files that sit in the context but never reach the image.
  3. 03 Layer Cache The effect of instruction order on the build is measured: the layer key is derived from the previous layer's key and the instruction's input digest, two instruction orders run over the same eight-build change sequence, and the cache hit rate, the count of regenerated layers, and bytes written are compared.
  4. 04 Multi-Stage Build Separating build tools from the output is measured: the same application is built single-stage and multi-stage, the final image's size, layer count, and count of unneeded files left inside are compared, and multi-stage building's cost is counted too — total bytes produced, unshipped intermediate layers, and cache behavior.
  5. 05 Base Image Selection Three base image candidates are measured by type designation: bytes, carried binaries and library count, and the presence of a shell and a package manager are counted; how many layers really change when the base updates is calculated, and the small base's hidden cost is measured in extra debugging steps and broken dependency bytes.
  6. 06 Tagging Scheme A tag is measured in a layered image registry: how many distinct content digests twenty builds produce and how many tags point to the same digest are counted, how many of the four layers really change when a tag moves is calculated, and the rate at which a deployment can be traced back to its source from its digest is measured under three separate record disciplines.
  7. 07 Image Registries A layer-shared image registry is built with real files and measured from disk: bytes sharing removes, layers that cannot be deleted because of reference counting once a retention rule applies, the drop in pull traffic when a locally present layer is skipped, and the layer count public and private images share are counted.
  8. 08 Image Security Image security is measured in three parts: how many bytes a file deleted in an upper layer really still occupies in the lower layer is counted in real directories, the caught, missed, and false-positive counts for a scan running against a known defect set are extracted, signing is built as a chain with a real key pair, and what gets accepted at every unverified link is counted.

03

Runtime

What isolation becomes at run time: run options through resource limits and environment variables, the ephemeral filesystem losing data, persistence through volumes and bind mounts, network drivers and service naming, the risk of running as the root user, a multi-container local environment through declarative compose files, hot reload and debugging's effect on developer experience, and runtime security through capability restriction and a read-only filesystem.

  1. 01 Run Options The two settings a container receives from outside: the cost of the throttle, kill, and degrade decisions when a resource limit is exceeded, measured in latency, lost work, and restarts; how a too-tight limit lands on the container's own work and a too-loose limit lands on the neighboring container; the difference environment variables leave outside the image; and how many variables being left undefined brings the service down.
  2. 02 Ephemeral Filesystem The fate of the data a container produces while running: building the writable layer with real directories, the distribution across data classes of the bytes accumulating over a thirty-night run, a one-byte change taking up an entire file's worth of space through copy-up, the number of records lost when the container is deleted, and which data class that loss is acceptable in.
  3. 03 Volumes and Bind Mounts Moving persistent data outside the writable layer: building a managed volume and a direct directory mount with real directories, the bytes remaining when the container is deleted, the number of nodes that cannot be written when the container's internal user identity does not match the host machine's file owner, and an absolute-path-bound mount breaking when the machine changes.
  4. 04 Container Networking Containers finding each other, and failing to: which boundary a service name's resolution is bound to, the number of paths that close when four services are split across two networks, separating published ports from network-only access, the outbound surface dropping from eight endpoints to one, and network membership not being an authorization.
  5. 05 Users and Permissions Three measures of running rootless: how many of fifteen entries stay open to the privileged identity, how many entries the switch to a rootless identity requires an ownership fix in, and how many paths in the bind mount stay closed after the fix because of ownership coming from the environment.
  6. 06 Multi-Container Local Environment Three measures of a declarative compose file: deriving the startup order from a dependency graph, the number of races born without a readiness check against the steps the check adds to startup, and the commands, flags, and ordering decisions that disappear compared to manual setup.
  7. 07 Developer Experience Comparing two feedback loops per change: the layers rebuilding the image invalidates, the bytes it copies, and its step count, against mounting the source and reloading the process zeroing out those same three numbers, and the environment distance that mounting costs.
  8. 08 Runtime Security A running container's authority is measured with two restrictions: how many of fourteen default capabilities have a legitimate operation and what replaces the ones dropped, how many write attempts a read-only root drops, the surface the paths left writable open, and how many of twelve abuse attempts close.

Start typing to search.

↑↓ ↵ Esc navigate · open · close