Build a container up from the four operating system features it is made of, so that image size, permission errors, the networking that does not behave and the build that takes nine minutes all become predictable consequences rather than mysteries

What a Container Actually Is

A container is an ordinary process with a changed view of the machine. This takes that view apart, one kernel feature at a time.

8 lessons, written and corrected before you arrived. Reading them here needs no account. The first reads the whole way through; the others open and then stop, because a page nobody owns cannot tell who is reading it. Starting the course gives you your own copy, where every idea has problems standing under it and you can ask about any sentence.

Start reading

01One Kernel, Many Processes, and No Boot Sequence AnywhereA container is a process the running kernel created with a few extra flags on the call, and both numbers people quote about containers follow from that.
02Six Views a Process Can Be Given Instead of Yoursopening onlyA namespace separates one kind of name rather than a machine, so the service calling itself process one is the host's process 24813 and the host's list settles every argument.
03A Different Root Directory, and Why It Is Not a Wallopening onlyReplacing the root of the file system for one process changes where path lookup begins and nothing else, which is why the image carries a whole distribution and why the file you wrote is gone.
04Half a Processor and 512 MB, and Why Only One of Them Killsopening onlyA quota inside a window gives a container half a processor and a memory limit gives it 512 MB, and the two edges behave nothing alike: one defers work in silence, the other kills a process.
05Layers, and Why One Line Rebuilds Sixty Megabytesopening onlyThe build cache has one rule and it chains, so the cost of an edit is the step you touched plus every step above it, and a later deletion never reaches the bytes below.
06Why the File It Wrote Is Owned by Rootopening onlyThe identity a container runs as is a number, the number means different things on the two sides of the boundary, and a permission error on a mounted directory is arithmetic over two of them.
07Follow One Request In, and Name Every Translation on the Wayopening onlyA container holds a network stack of its own, so the same address means two different things inside and outside. One request is followed across the join and every hop priced.
08The Boundary Is a View, and the Kernel Underneath It Is Sharedopening onlyA container's isolation is a set of values one shared kernel checks. What that leaves possible, what answers each class of weakness, and when the boundary has to be a kernel of its own.