Tag: #container

← All posts

• Bringing Container Images into an Air-Gapped Network — podman save and skopeo Are Different Tools

  Once the RPM transfer procedure has settled into place, the next request is almost always container images. It starts by separating podman save from the skopeo copy family — one goes through the local image store, the ot

  2026-08-14 · 12 min read #linux#rhel#air-gap#podman#skopeo

• The Generational Shift in Container Infrastructure — What Eleven Projects Left Behind

  Eleven projects that were once standard parts of a container infrastructure and have since been replaced, documented using only official notices and repository archive status as evidence. rkt, dockershim, Classic Swarm,

  2026-08-12 · 10 min read #open-source#kubernetes#container#docker#infrastructure

• You Added Registry Instances and Availability Did Not Move — What zot Scale-Out Actually Sells

  Taking zot as the example, this post takes apart the scaling design of a container registry. A structure that assigns repositories to instances by consistent hashing and has non-owner nodes proxy the request onward is sh

  2026-08-09 · 8 min read #devops#oci#registry#zot#container

• How to Read Container Image Vulnerability Scan Results — The Real Way to Turn Hundreds of Criticals Into Zero

  Run an image scanner for the first time and you get thousands of vulnerabilities, a good number of them Critical. Hand that report to the team as is and nothing happens. This post starts from the fact that all a scanner

  2026-07-26 · 13 min read #security#container#docker#trivy#kubernetes

• What Actually Differs Between a Container and a VM — namespace, cgroup, and the Bill for Sharing a Kernel

  Starts with why the explanation that a container is a lightweight VM breeds misunderstanding. A container is an ordinary Linux process whose view is masked by namespaces and whose resources are limited by cgroups, and it

  2026-07-26 · 13 min read #docker#container#linux-namespace#cgroup#virtualization

• Shrinking Docker Images — The Truth About Layers, Multi-Stage Builds, and What a Base Image Really Costs

  Start by pinpointing, layer by layer with dive, exactly where a Docker image balloons to 1.9GB. This piece covers why the union filesystem makes RUN rm incapable of removing a single byte from an image, exactly what a mu

  2026-07-26 · 12 min read #docker#dockerfile#multi-stage-build#container#devops

• Podman 6.0 — slirp4netns, CNI, and cgroups v1 Removed; macOS's Default Provider Is Now libkrun

  On June 24, 2026, Podman 6.0.0 shipped as its first major release in 27 months since 5.0. Support for slirp4netns, CNI, iptables, cgroups v1, and BoltDB was removed all at once, Intel Mac and Windows 10 support was dropp

  2026-07-17 · 13 min read #container#podman#docker#linux#macos

• EROFS Native Layers in containerd 2.3 — What You Get in Exchange for Removing Unpack

  containerd 2.3, released on April 30, 2026, opened a path to pull an EROFS filesystem image straight from the registry and mount it as-is. Since there's no tar to unpack, the entire unpack step disappears, leaving behind

  2026-07-16 · 18 min read #container#containerd#oci#storage#linux

• Containers Are a Lie — The Kernel Truth Behind cgroups and Namespaces

  There is no container object in the kernel. A tour of the seven namespaces, hands-on cgroup v2 file manipulation, building a mini container with unshare and pivotroot, overlayfs, capabilities, and seccomp — we dissect ea

  2026-06-13 · 17 min read #linux#kernel#container#cgroups#namespaces

• A Deep Dive into apple/container — The Lightweight VM Approach to macOS Containers ♪ Listenable

  We examine the limits of Docker Desktop and its single shared Linux VM on macOS, then analyze the one-VM-per-container model adopted by apple/container. The post covers the Container Machine feature unveiled at WWDC26, a

  2026-06-12 · 19 min read #apple-container#virtualization#macos#docker#container

• Container Registries in 2026 — Docker Hub / GHCR / ECR / Harbor / Quay / Zot / Cosign + Sigstore Deep Dive ♪ Listenable

  In 2026, container registries are no longer just a docker push away. Following Docker Hub pricing changes, GHCR has effectively become the OSS standard. Harbor has matured into the self-hosting default as a CNCF graduate

  2026-05-16 · 27 min read #container#registry#docker-hub#ghcr#ecr

• Docker Desktop Alternatives 2026 — Podman / OrbStack / Colima / Finch / Rancher Desktop Deep-Dive Comparison ♪ Listenable

  Five years after Docker Desktops August 2021 pricing change, the container tooling landscape has been completely reshaped. In 2026, containerd is the de facto industry-standard runtime, and on top of it sit a constellati

  2026-05-15 · 22 min read #docker#podman#orbstack#colima#finch

• A Modern Understanding of the Operating System — io_uring, cgroups/namespaces, eBPF, NUMA, GPU UVM, EEVDF, Zero-Copy Complete Guide (2025)

  iouring as the successor to epoll, the cgroups + namespaces that made Docker, the eBPF that injects code into the kernel safely, the hidden cost NUMA imposes, GPU drivers and UVM, the EEVDF scheduler that landed in Linux

  2026-04-15 · 13 min read #operating-systems#linux#io-uring#cgroups#namespaces

• Container & Docker Internals Deep Dive — Namespace, cgroups, OverlayFS, seccomp, Capabilities and Kubernetes (2025)

  "A container is not a lightweight VM." Behind a single docker run there are 7 Linux namespaces, cgroups v2, OverlayFS layers, seccomp filters, and Linux capabilities. From LXC in 2008 to Docker in 2013, OCI standardizati

  2026-04-15 · 12 min read #docker#container#namespace#cgroups#overlayfs

• Docker & Kubernetes Essentials — From Containers to Orchestration

  Everything about containers: Docker fundamentals, Dockerfile best practices, Kubernetes core concepts (Pod/Service/Deployment), Helm, and real-world deployment.

  2026-04-12 · 15 min read #devops#docker#kubernetes#container#orchestration

• Docker Complete Guide 2025: From Container Basics to Multi-stage Builds, Compose, and Production Deployment ♪ Listenable

  From container internals (namespaces, cgroups) to Dockerfile optimization, 90% image size reduction with multi-stage builds, Docker Compose in practice, security best practices, and CI/CD pipelines — a complete Docker gu

  2026-03-22 · 21 min read #docker#container#devops#dockerfile#docker-compose

• [Linux] Complete Guide to cgroups: The Core of Container Resource Control ♪ Listenable

  A comprehensive guide to Linux cgroups (Control Groups): concepts, v1 vs v2 differences, CPU/memory/IO/PID limiting, usage in Docker and Kubernetes, and real-world troubleshooting.

  2026-03-20 · 22 min read #linux#cgroups#container#kubernetes#devops

• The Complete Guide to Container & Kubernetes Network Debugging

  A systematic guide to debugging container networking, from Docker networking models to Kubernetes CNI, Service DNS, Network Policies, and Calico/Cilium troubleshooting with practical commands.

  2026-03-08 · 12 min read #networking#kubernetes#docker#container#troubleshooting

• Security vulnerability action playbook: OS package, container image, runtime hardening

  We organize a practical security operation playbook that covers everything from CVE discovery to action, verification, and reporting, OS package vulnerability patching, container image security, and runtime hardening.

  2026-03-07 · 16 min read #devops#security#vulnerability#cve#container

• Managing CI/CD Pipelines as Code with Dagger: Same Pipeline from Local to CI

  Learn how to write CI/CD pipelines in a programming language using Dagger and run them identically in both local and CI environments. Integration with GitHub Actions and GitLab CI is also covered.

  2026-03-03 · 7 min read #devops#dagger#ci-cd#pipeline-as-code#container