Revision · Containers

Part 3 attacks “works on my machine” head-on: a container ships the entire environment as one artifact, so the bytes you tested are the bytes that run. Its throughline is that a container is not a tiny VM — it is a normal Linux process wearing a costume.

What this part covered

• Why containers — they deliver reproducibility, isolation, and density by sharing the host kernel instead of virtualizing hardware, so images are megabytes not gigabytes and start in milliseconds; a VM is still right when you need the stronger hypervisor boundary.
• Namespaces and cgroups — there is no “container” object in the kernel: a container is a process plus namespaces (what it can see — PID, mount, network, UTS, IPC, user) plus cgroups (what it can use — --memory, --cpus) plus an image (its filesystem).
• Images and layers — an image is stacked read-only layers merged by a union filesystem, deduplicated and content-addressed by SHA-256 digest; layer order decides whether a rebuild is 2 seconds or 5 minutes, and slim/alpine/distroless bases keep them small.
• Dockerfiles — turn a wiki of setup steps into a version-controlled, reviewable recipe; order instructions by change frequency, use the exec form so PID 1 receives SIGTERM, add a .dockerignore to keep secrets and bloat out, and use multi-stage builds to copy only artifacts into a slim final image.
• Secrets and build context — anything baked into a layer is readable forever (a later RUN rm does not remove it), so inject secrets at build-mount or run time, never COPY them in.
• Registries — the shared “build once, run everywhere” store where tags are mutable pointers for humans and digests are immutable fingerprints for machines; deploy by digest because latest silently reintroduces environment drift across the fleet.
• Provenance — beyond the digest (integrity), signatures via cosign/Sigstore prove origin and an SBOM says what is inside for CVE exposure.
• Networking and volumes — each container gets a private network namespace; bridge networks plus embedded DNS let containers find each other by name (db:5432) instead of brittle IPs, -p publishes ports, and volumes hold the durable state that the ephemeral writable layer cannot.
• Stateless containers — keep no important data on the container’s own filesystem so it is cattle, not pets: that is what makes scaling, self-healing, and rolling deploys/rollbacks safe.

The takeaway

Containers solve “one app, one box, runs anywhere” — the reproducible unit everything later is built from. What they do not solve is running a fleet across many machines that crash, scale, and move (that is orchestration with Kubernetes) or building and shipping these images automatically on every commit (that is CI/CD). Master the unit here, and those larger problems become tractable.