Containers

A Linux container runs processes with isolated resources and limits while sharing the host kernel.

What isolation is made of

Namespaces separate resources such as process IDs, mounts and networking. Cgroups control resource use. Capabilities restrict privileged operations, and seccomp filters system calls.

User namespaces map container users to different host users. Rootless containers use this to reduce host privileges.

Images and layers

An image contains configuration and filesystem layers. A running container adds a writable layer. Deleting a file in a later image layer does not remove it from earlier layers.

Keep secrets out of image layers. Use build secrets for credentials needed during a build, and multi-stage builds to separate build tools from the final image.

Put rarely changing Dockerfile steps before frequently changing ones to make better use of the build cache.

The runtime stack

Docker and Podman provide the commands you use. Lower-level runtimes create the processes and apply isolation. OCI specifications define the image and runtime formats.

Networking

Bridge networks give containers separate network interfaces. Publishing a port exposes it through the host. Host networking uses the host's network directly.

On a Compose network, services can usually reach each other by service name. localhost inside a container refers to that container.

Where it goes wrong

• Use an exec-form entrypoint so the application receives stop signals. An init process can also forward signals and reap child processes.
• Exit 137 means SIGKILL. Check the container's OOM status and host logs before assuming it ran out of memory.
• Check the image architecture if a binary will not start.
• Use volumes for data that must survive replacing a container.

What belongs where

A bind mount can hide files already present at its destination in the image. Check mounts when a container appears to be missing an installed dependency.

Compose projects

A Compose file describes related services, their networks, volumes and configuration. A service being started does not mean its application is ready. Use health checks and retry connections when another service may still be initialising.

Give databases persistent storage and record how to back them up. Recreating a container is routine; recreating its data is a different operation.

Debugging a container

Inspect logs, exit status, mounts, environment and network configuration. Compare the command actually running with the command you intended. If a port is unavailable, check both the application's listening address and the host's published port.

Pin versions when reproducibility matters, and record image digests for deployments. A tag can be moved to a different image.

Reading

• OCI specifications
• Namespaces and cgroups
• BuildKit documentation