Engineering / advanced
The mechanics of isolated workloads
Inspect the lifecycle of a container through filesystem mounts, process setup, resource accounting, and runtime failure behavior.
Your route through engineering
Follow the path or begin with a question. Every lesson is open.
Your place, at your pace. Progress is optional and saved only in this browser when available.
Read / explore / reason
Inside this module
Module 01 advanced
The mechanics of isolated workloads
Inspect the lifecycle of a container through filesystem mounts, process setup, resource accounting, and runtime failure behavior.
- 01
Container init: signals, children, and the lifetime of PID 1
Trace namespace init, orphan adoption, wait-based reaping, and shutdown without assuming that a shell wrapper behaves like an init process.
25 min - 02
Mount propagation: isolate topology as well as pathnames
Distinguish mount namespaces, shared peer groups, slave propagation, recursive operations, and root changes from ordinary file-content isolation.
26 min - 03
OverlayFS: a small write can trigger a large copy-up
Trace upper/lower lookup, data and metadata copy-up, whiteouts, and storage amplification under explicit OverlayFS feature settings.
25 min - 04
User namespaces: map identities without inventing host authority
Apply an explicit UID/GID range mapping and distinguish namespace-relative privilege from permissions on host resources and other kernel boundaries.
26 min - 05
Capabilities: remove authority from the right sets at the right time
Distinguish effective, permitted, inheritable, bounding, and ambient capability sets and verify the final post-exec privilege state.
27 min - 06
Seccomp filters: inspect syscall arguments without inventing pathname knowledge
Define the data available to a Linux seccomp BPF filter, its action composition, inheritance, ABI checks, and limitations around pointed-to memory.
27 min - 07
CPU quota: a shared time budget rather than dedicated cores
Relate cgroup v2 quota and period to aggregate CPU time, bursty parallel consumption, hierarchical throttling, and measured scheduling behavior.
26 min - 08
Memory controls: pressure, hard limits, and OOM evidence
Distinguish cgroup v2 memory.high and memory.max, hierarchical charging, reclaim, swap, and evidence for why a process was killed.
27 min - 09
Devices and hooks: preserve the actual trust boundary
Separate device-node visibility from device authorization and scope OCI hook execution to the correct namespace, phase, and privilege context.
27 min - 10
Container forensics: reconstruct the failing transition
Correlate runtime phases, process identity, namespace and mount state, file descriptors, and cgroup event deltas before assigning a cause.
28 min