CPU Rings & Traps
How CPUs protect themselves — and why virtualizing x86 was a 20-year puzzle x86 CPUs implement hardware-enforced privilege levels called protection rings.…
Virtualization
Hypervisors (KVM, QEMU, virtio)
The software layer that makes virtual machines possible Two Fundamental Architectures Every hypervisor falls into one of two categories based on where it…
Namespace Theory & Core Types
The isolation primitive — giving each process its own view of the system Namespaces are a Linux kernel feature that partitions kernel resources so that one…
Advanced Types & Container Birth
IPC, User, Cgroup, Time namespaces — and how they combine to create a container IPC namespaces isolate inter-process communication resources. Processes in…
cgroup Fundamentals
Resource control at the kernel level — not isolation, but limits and accounting Control Groups (cgroups) are a Linux kernel feature for limiting, accounting,…
Controllers (CPU, Memory, I/O)
CPU throttling, memory limits, I/O control, and fork bomb protection The CPU controller manages how much processor time a cgroup gets. It has two distinct…
cgroups in Practice (Docker & K8s)
How container platforms translate user-facing flags to cgroup files Every Docker resource flag is a thin wrapper around writing a value to a cgroup file.…
Capabilities & Seccomp
Splitting root into pieces and filtering dangerous syscalls Binary privilege model: A process that needs to bind port 80 gets the same powers as one that…
LSMs, AppArmor & SELinux
Mandatory Access Control — the last line of container defense What is LSM? LSM is a framework of hooks placed throughout the Linux kernel. When the kernel is…
OCI Image Specification
What a container image actually is — not a VM disk, but a stack of tarballs with metadata Key Mental Model A container image is not a VM disk image. There is…
Union Filesystems & OverlayFS
How multiple read-only layers merge into a single writable filesystem view Core Idea A union filesystem merges multiple directories into a single unified…
Building Images (Dockerfile & BuildKit)
Dockerfile mechanics, layer caching, multi-stage builds, and BuildKit A Dockerfile is a sequence of instructions that produce an OCI image. Each instruction…
OCI Runtime Spec & runc
Given a rootfs and a config.json — how a container actually starts A Standard Interface for Running Containers Filesystem tree (bin, lib, etc, usr...)…
containerd & CRI
Why runc isn't enough — image management, supervision, and Kubernetes integration Origin & Status Image Pull & Push Snapshots Task Management Content Store
Sandboxed Runtimes
When shared kernel isn't secure enough — gVisor, Kata, Firecracker, and Wasm Trusted workload Untrusted code / attacker Another tenant Why Namespaces +…
Docker Architecture
From docker run to container process — every layer of the Docker stack Every docker run traverses this chain of processes before a container exists: Parses…
Volumes & Storage
Solving the persistence problem — bind mounts, named volumes, and tmpfs Why Container Storage Is Not Enough Bind Mounts Good for: development (live code…
Resource Limits
CPU, memory, I/O, and PID limits — and what happens when they're exceeded Hard Limit: --cpus Sets the maximum number of CPU cores a container can use.…
Control Plane
The brain of the cluster — API server, etcd, scheduler, and controllers A Kubernetes cluster is split into the control plane (the brain) and worker nodes…
Kubelet & Container Runtime
The node agent — from scheduled pod to running containers The kubelet is the node-level agent that runs on every node in the cluster. It takes pod specs from…
Workloads & Scheduling
Deployments, StatefulSets, DaemonSets — and how pods land on nodes A Deployment manages ReplicaSets, which manage Pods. It's the standard way to run…
PV, PVC & StorageClass
Kubernetes persistent storage — abstracting infrastructure from applications PersistentVolume (PV) A piece of storage provisioned by an admin or dynamically.…
Container Storage Interface (CSI)
Decoupling storage providers from Kubernetes — the plugin architecture A CSI driver deploys two components in the cluster: CSI Controller Container…
Proxmox Architecture
Open-source virtualization management — KVM VMs and LXC containers on Debian Proxmox Virtual Environment at a Glance pve-manager Web interface & API server.…
VM Lifecycle & Networking
Creating, migrating, and connecting VMs in Proxmox Three Ways to Create a VM From ISO Upload ISO to storage, create VM, attach ISO as CD-ROM, boot and…
Storage & High Availability
Storage backends, ZFS, Ceph, clustering, and automatic failover Proxmox supports many storage backends. The choice determines whether you get snapshots, thin…
