A container's isolation is only as strong as the code that serves its syscalls. With runc, that code is the host kernel, shared by every container on the node: namespaces, cgroups and seccomp are checks inside it; one bug in a syscall path the container can reach is code execution in the host kernel. A sandboxed …

A container is an ordinary Linux process, wrapped in constraints the kernel already has. The kernel has no container object. A container is a process tree plus: namespaces: its own view of PIDs, the network, the mounts, the hostname; a cgroup: limits on memory, CPU and the number of processes; a changed root: the …

A Service gives a group of pods one address that lasts as long as the Service, while the pods behind it come and go. The cluster is the Pod Network's. First a pod is replaced under a client that held its address. Then one Service, web, grows through its three types: ClusterIP: an address inside the cluster, for pods; …

Every node in a Kubernetes cluster has one address on the network the nodes share, and every pod an address of its own, from its node's range. The cluster is the Top View's. We follow a packet from pod to pod: on one node, then across two. Then a network policy filters it. Kubernetes sets the rules for this network, …

A working Kubernetes cluster: five computers, and a cluster admin running kubectl against them. A node is a computer. A pod is a group of one or more containers, running on one node. We look inside the nodes first, then run a pod, then a Deployment, then delete it. Reading the drawing Solid purple is the control plane; …

Motivation Can containers run inside other containers? YES! Is there a use case for such a case? Well, one famous one is the ability to run Kubernetes cluster in a single machine, using containers. This is what the minikube software is doing If you run jenkins inside containers, it may be useful as well. In the next …

Kubernetes has a page of its own Interactive views Linux Containers: the Runtime Stack — docker run and a pod, down through containerd, the shim and runc, to the namespaces, cgroup, mounts and privileges a container is made of Sandboxed Container Runtimes — the one kernel runc containers share, gVisor's user-space …

Container Networking Basics (based on the introduction here) Containers have networking enabled by default, and they can make outgoing connections. A container has no information about what kind of network it's attached to, or whether their peers are also Docker workloads or not. A container only sees a network …

Why do we need containers? (a practical example) Let's say you are a developer, and is writing a Java program. You need JDK, because this is where your Java compiler is. You need Java Runtimn, because it will run the bytecode that your compiler will create. You may need to run all of this on top of the specific O.S you …

...it was working on my machine... When we are creating a program, we solve problems until we see it working on our development workstation. When deploying it to other machines (servers), things may fail, because some things are different there. What could be the difference? Address Space separation A program running …