The OSI Model
The 7-layer reference model — a mental framework for networking The OSI (Open Systems Interconnection) model was developed by the ISO in 1984 as a conceptual…
Learn
Technical foundations for platform engineers
Networking, virtualization and Linux storage — from first principles to what breaks in production. Written to be read, and reused.
The TCP/IP Model
The 4-layer model that actually runs the internet The TCP/IP model (also called the Internet Protocol Suite) is the practical, implementation-driven…
Encapsulation
How data gets wrapped at each layer for transmission Encapsulation is the process by which each layer of the networking stack wraps the data from the layer…
Ethernet
Layer 2 — the protocol that connects everything on a LAN Every piece of data that moves across a local network is wrapped in an Ethernet frame. The frame…
Switching
How switches learn, forward, and filter traffic A switch is fundamentally a MAC-address-to-port mapping engine. It maintains a table (historically called the…
VLANs (802.1Q)
Logical network segmentation at Layer 2 A VLAN (Virtual LAN) is a logical partition of a physical switch into multiple independent broadcast domains. Without…
IPv4
32-bit addressing, subnetting, and the protocol that built the internet An IPv4 address is a 32-bit number, written as four octets in dotted-decimal…
IPv6
128-bit addresses — solving exhaustion and simplifying the protocol IPv6 addresses are written as 8 groups of 4 hexadecimal digits, separated by colons. The…
IP Routing
How routers make forwarding decisions Every host and router maintains a routing table (also called a FIB — Forwarding Information Base). When a packet…
Dynamic Routing (OSPF & BGP)
OSPF, BGP, and how the internet finds paths Routes within a single Autonomous System (AS). Optimized for fast convergence within a single administrative domain.
TCP Deep Dive
Reliable, ordered, connection-oriented transport Every TCP segment carries a 20-byte minimum header (up to 60 bytes with options). This header is the control…
TCP State Machine
Connection lifecycle from LISTEN to CLOSED Every TCP connection traverses a well-defined state machine. Understanding these states is essential for…
UDP
Connectionless, fast, no guarantees UDP (User Datagram Protocol) is the other major Layer 4 transport protocol. Where TCP provides a reliable, ordered byte…
Ports & Sockets
How the OS multiplexes network connections A port is a 16-bit number (0-65535) that identifies a specific process or service on a host. Ports exist at Layer…
How DNS Works
The complete resolution process — from query to answer DNS is not a single server or a flat lookup table. It is a globally distributed, hierarchical database…
DNS Record Types
A, AAAA, CNAME, MX, TXT, SRV, and more DNS is more than name-to-IP mapping. Each record type serves a specific purpose in the DNS ecosystem. Here is a…
Advanced DNS
Split-horizon, anycast, DNSSEC, and encrypted DNS Split-horizon (also called "split-brain" or "views") is a DNS configuration where the same domain name…
HTTP (1.1 / 2 / 3)
The application protocol of the web — from 1.1 to 3 HTTP (Hypertext Transfer Protocol) is a request-response protocol operating at Layer 7. The client sends…
TLS
Transport Layer Security — encryption, authentication, integrity TLS (Transport Layer Security) sits between the application layer and the transport layer.…
mTLS & Certificate Management
Mutual authentication and practical certificate operations In standard TLS, only the server authenticates itself to the client by presenting a certificate.…
Web Servers
What they do, how they handle connections, and how they fit in the stack A web server is a process that listens on a TCP socket (typically port 80/443),…
Firewalls
Packet filtering — stateless, stateful, and Linux iptables/nftables A stateless firewall evaluates each packet independently against a static rule set. It…
NAT
Network Address Translation — the IPv4 survival hack IPv4 has ~4.3 billion addresses. There are ~20+ billion connected devices. NAT is the hack that made…
VPNs
Encrypted tunnels — IPsec, OpenVPN, and WireGuard A VPN creates an encrypted tunnel between endpoints, making it appear as if they share a private network…
NAT Types & Behavior
How different NATs affect connectivity — RFC 4787 classification The old "cone NAT" terminology is imprecise and frequently misused. RFC 4787 (2007) replaced…
STUN, TURN & ICE
The protocols that punch through NATs Defined in RFC 8489 (supersedes RFC 5389 and the original RFC 3489). STUN's core purpose is simple: tell a client what…
Tailscale Architecture
How Tailscale achieves direct, encrypted connections through NATs Tailscale's architecture is split into two completely separate planes: a control plane…
Tailscale Features
MagicDNS, ACLs, subnet routers, and the full feature set Every device on a tailnet gets a stable DNS name automatically. No manual DNS records, no editing…
NAT Traversal Deep Dive
How direct connections happen through NATs — based on Tailscale's "How NAT Traversal Works" Devices behind NAT lack direct internet reachability. The core…
Namespaces & Virtual Interfaces
The kernel primitives that make container networking possible A network namespace is a kernel construct that provides a complete, independent copy of the…
Netfilter Internals
The kernel framework behind iptables, conntrack, and NAT Netfilter is a kernel framework that provides hook points in the network stack where kernel modules…
iproute2 & Traffic Control
Modern Linux networking tools: ip, tc, and sysctl knobs iproute2 is the modern replacement for the legacy net-tools package. It provides a unified interface…
eBPF Fundamentals
Sandboxed programs in the kernel — the programmable data plane eBPF (extended Berkeley Packet Filter) allows you to run sandboxed, event-driven programs…
XDP & tc-bpf
Programmable packet processing at line rate XDP is the earliest programmable hook point in the Linux networking stack. It processes packets at the NIC driver…
Cilium
eBPF-powered networking for Kubernetes Cilium is an eBPF-based CNI (Container Network Interface) plugin for Kubernetes. It replaces traditional…
Cloud-Init Basics
The industry standard for instance initialization Cloud-init is the de facto standard for configuring Linux instances at first boot. It handles everything…
User-Data & Cloud-Config
Configuring instances with YAML and scripts User-data is the blob you pass to an instance at launch time. Cloud-init inspects the first bytes to determine…
Network Configuration
Configuring networking via cloud-init and Netplan Cloud-init supports two network configuration formats. The format is specified in the network-config data…
Docker Networking
Container networking from the kernel up Docker networking is not magic — it is built entirely on Linux kernel primitives: network namespaces, virtual…
CNI (Container Network Interface)
The CNCF standard that Kubernetes uses for pod networking CNI (Container Network Interface) is a CNCF specification that defines a standard interface between…
Pod Networking
How every Pod gets a unique, routable IP The Kubernetes networking model is built on three non-negotiable constraints. Every CNI plugin must satisfy all…
Services
Service discovery, load balancing, and the kube-proxy implementation Pod IPs are ephemeral. Every time a Pod restarts, gets rescheduled, or scales, it gets a…
Ingress & Gateway API
L7 routing — exposing services to the outside world Ingress provides L7 (HTTP/HTTPS) routing into the cluster. Instead of one LoadBalancer per Service…
Network Policies
Pod-level firewall rules and service mesh basics By default, Kubernetes has a flat, open network — every Pod can talk to every other Pod, across all…
CPU Rings & Traps
How CPUs protect themselves — and why virtualizing x86 was a 20-year puzzle x86 CPUs implement hardware-enforced privilege levels called protection rings.…
Hypervisors (KVM, QEMU, virtio)
The software layer that makes virtual machines possible Runs directly on hardware — no host OS underneath. Examples: VMware ESXi, Xen, Microsoft Hyper-V Runs…
Namespace Theory & Core Types
The isolation primitive — giving each process its own view of the system Namespaces are a Linux kernel feature that partitions kernel resources so that one…
Advanced Types & Container Birth
IPC, User, Cgroup, Time namespaces — and how they combine to create a container IPC namespaces isolate inter-process communication resources. Processes in…
cgroup Fundamentals
Resource control at the kernel level — not isolation, but limits and accounting Control Groups (cgroups) are a Linux kernel feature for limiting, accounting,…
Controllers (CPU, Memory, I/O)
CPU throttling, memory limits, I/O control, and fork bomb protection The CPU controller manages how much processor time a cgroup gets. It has two distinct…
cgroups in Practice (Docker & K8s)
How container platforms translate user-facing flags to cgroup files Every Docker resource flag is a thin wrapper around writing a value to a cgroup file.…
Capabilities & Seccomp
Splitting root into pieces and filtering dangerous syscalls Binary privilege model: A process that needs to bind port 80 gets the same powers as one that…
LSMs, AppArmor & SELinux
Mandatory Access Control — the last line of container defense Traditional Unix file permissions: If a process runs as root, DAC provides zero protection.…
OCI Image Specification
What a container image actually is — not a VM disk, but a stack of tarballs with metadata The OCI Image Specification defines four components that together…
Union Filesystems & OverlayFS
How multiple read-only layers merge into a single writable filesystem view OverlayFS is a kernel-level union filesystem that has been the default storage…
Building Images (Dockerfile & BuildKit)
Dockerfile mechanics, layer caching, multi-stage builds, and BuildKit A Dockerfile is a sequence of instructions that produce an OCI image. Each instruction…
OCI Runtime Spec & runc
Given a rootfs and a config.json — how a container actually starts Filesystem tree (bin, lib, etc, usr...) Namespaces, cgroups, mounts, process, hooks…
containerd & CRI
Why runc isn't enough — image management, supervision, and Kubernetes integration Issues API calls gRPC daemon: images, snapshots, tasks Parent process,…
Sandboxed Runtimes
When shared kernel isn't secure enough — gVisor, Kata, Firecracker, and Wasm Trusted workload Untrusted code / attacker Another tenant Intercepts and handles…
Docker Architecture
From docker run to container process — every layer of the Docker stack Every docker run traverses this chain of processes before a container exists: Parses…
Volumes & Storage
Solving the persistence problem — bind mounts, named volumes, and tmpfs Volumes and bind mounts are overlaid on top of the overlay2 merged view at specific…
Resource Limits
CPU, memory, I/O, and PID limits — and what happens when they're exceeded Real-time resource usage monitoring — reads directly from cgroup accounting files.
Control Plane
The brain of the cluster — API server, etcd, scheduler, and controllers A Kubernetes cluster is split into the control plane (the brain) and worker nodes…
Kubelet & Container Runtime
The node agent — from scheduled pod to running containers The kubelet is the node-level agent that runs on every node in the cluster. It takes pod specs from…
Workloads & Scheduling
Deployments, StatefulSets, DaemonSets — and how pods land on nodes A Deployment manages ReplicaSets, which manage Pods. It's the standard way to run…
PV, PVC & StorageClass
Kubernetes persistent storage — abstracting infrastructure from applications A PVC binds to a matching PV based on: capacity, access mode, storage class, and…
Container Storage Interface (CSI)
Decoupling storage providers from Kubernetes — the plugin architecture A CSI driver deploys two components in the cluster: CSI drivers don't talk to the K8s…
Proxmox Architecture
Open-source virtualization management — KVM VMs and LXC containers on Debian Each Proxmox KVM VM is ultimately a QEMU process running on the host. Proxmox…
VM Lifecycle & Networking
Creating, migrating, and connecting VMs in Proxmox Proxmox reads /etc/pve/qemu-server/<vmid>.conf qemu-server translates config into qemu-system-x86_64 args
Storage & High Availability
Storage backends, ZFS, Ceph, clustering, and automatic failover Proxmox supports many storage backends. The choice determines whether you get snapshots, thin…
Disks, SSDs & NVMe
HDDs, SSDs, NVMe, and how the kernel sees them Before looking at devices, it helps to see where they sit. A userspace write travels through multiple…
Partitions (MBR & GPT)
MBR, GPT, and how disk space gets divided A block device is a flat array of LBAs — 0, 1, 2, …, N-1. A partition is nothing more than a named range of those…
Filesystem Fundamentals
Inodes, journaling, VFS, and how files are actually stored A filesystem is a data structure laid out on top of a block device. The block device exposes a…
ext4 & XFS
The two mainstream Linux filesystems — internals and trade-offs On a modern Linux system, the default root filesystem is almost always ext4 (Debian, Ubuntu)…
RAID Levels
Combining disks for performance, redundancy, or both RAID — Redundant Array of Independent Disks (originally "Inexpensive" in the 1988 Berkeley paper by…
Linux Software RAID (mdadm)
Managing arrays with the Linux MD subsystem mdadm (multi-disk admin) is the userspace administration tool for the Linux kernel's MD (Multiple Device)…
Device Mapper
The kernel framework behind LVM, LUKS, and thin pools Consider a typical laptop: ext4 on top of an LVM logical volume, LVM on top of a LUKS-encrypted…
LVM Fundamentals
Physical Volumes, Volume Groups, and Logical Volumes LVM (Logical Volume Manager) is an abstraction layer that sits between raw block devices and the…
Thin Provisioning & Snapshots
Allocate on demand, snapshot at scale Thin provisioning decouples the size an LV advertises from the capacity it has actually consumed. Multiple thin LVs…
dm-crypt & LUKS
Full-disk encryption the Linux way Linux full-disk encryption is built from two independent layers that are almost always used together, but it's critical to…
LUKS Keys, crypttab & Auto-Unlock
Multiple unlock methods and integrating with systemd LUKS's defining feature for operators is that a single master key can be unlocked by multiple…
TPM Fundamentals
Trusted Platform Module — sealing secrets to hardware state A Trusted Platform Module is a dedicated secure crypto-processor specified by the Trusted…
Secure Boot & LUKS Auto-Unlock
Tying UEFI, TPM, and LUKS together Secure Boot is a UEFI feature that enforces signature checks on every boot-time EFI binary. Before executing anything, the…
ZFS
The integrated filesystem, volume manager, RAID, and integrity layer ZFS was developed at Sun Microsystems starting in 2001 and marketed as “the last word in…
btrfs
Linux-native copy-on-write filesystem btrfs (B-Tree FS, pronounced butter FS or better FS) started at Oracle in 2007 and has been in the mainline Linux…
