CPU Rings & Traps
How CPUs protect themselves — and why virtualizing x86 was a 20-year puzzle x86 CPUs implement hardware-enforced privilege levels called protection rings.…
Virtualization
Hypervisors (KVM, QEMU, virtio)
The software layer that makes virtual machines possible Runs directly on hardware — no host OS underneath. Examples: VMware ESXi, Xen, Microsoft Hyper-V Runs…
Namespace Theory & Core Types
The isolation primitive — giving each process its own view of the system Namespaces are a Linux kernel feature that partitions kernel resources so that one…
Advanced Types & Container Birth
IPC, User, Cgroup, Time namespaces — and how they combine to create a container IPC namespaces isolate inter-process communication resources. Processes in…
cgroup Fundamentals
Resource control at the kernel level — not isolation, but limits and accounting Control Groups (cgroups) are a Linux kernel feature for limiting, accounting,…
Controllers (CPU, Memory, I/O)
CPU throttling, memory limits, I/O control, and fork bomb protection The CPU controller manages how much processor time a cgroup gets. It has two distinct…
cgroups in Practice (Docker & K8s)
How container platforms translate user-facing flags to cgroup files Every Docker resource flag is a thin wrapper around writing a value to a cgroup file.…
Capabilities & Seccomp
Splitting root into pieces and filtering dangerous syscalls Binary privilege model: A process that needs to bind port 80 gets the same powers as one that…
LSMs, AppArmor & SELinux
Mandatory Access Control — the last line of container defense Traditional Unix file permissions: If a process runs as root, DAC provides zero protection.…
OCI Image Specification
What a container image actually is — not a VM disk, but a stack of tarballs with metadata The OCI Image Specification defines four components that together…
Union Filesystems & OverlayFS
How multiple read-only layers merge into a single writable filesystem view OverlayFS is a kernel-level union filesystem that has been the default storage…
Building Images (Dockerfile & BuildKit)
Dockerfile mechanics, layer caching, multi-stage builds, and BuildKit A Dockerfile is a sequence of instructions that produce an OCI image. Each instruction…
OCI Runtime Spec & runc
Given a rootfs and a config.json — how a container actually starts Filesystem tree (bin, lib, etc, usr...) Namespaces, cgroups, mounts, process, hooks…
containerd & CRI
Why runc isn't enough — image management, supervision, and Kubernetes integration Issues API calls gRPC daemon: images, snapshots, tasks Parent process,…
Sandboxed Runtimes
When shared kernel isn't secure enough — gVisor, Kata, Firecracker, and Wasm Trusted workload Untrusted code / attacker Another tenant Intercepts and handles…
Docker Architecture
From docker run to container process — every layer of the Docker stack Every docker run traverses this chain of processes before a container exists: Parses…
Volumes & Storage
Solving the persistence problem — bind mounts, named volumes, and tmpfs Volumes and bind mounts are overlaid on top of the overlay2 merged view at specific…
Resource Limits
CPU, memory, I/O, and PID limits — and what happens when they're exceeded Real-time resource usage monitoring — reads directly from cgroup accounting files.
Control Plane
The brain of the cluster — API server, etcd, scheduler, and controllers A Kubernetes cluster is split into the control plane (the brain) and worker nodes…
Kubelet & Container Runtime
The node agent — from scheduled pod to running containers The kubelet is the node-level agent that runs on every node in the cluster. It takes pod specs from…
Workloads & Scheduling
Deployments, StatefulSets, DaemonSets — and how pods land on nodes A Deployment manages ReplicaSets, which manage Pods. It's the standard way to run…
PV, PVC & StorageClass
Kubernetes persistent storage — abstracting infrastructure from applications A PVC binds to a matching PV based on: capacity, access mode, storage class, and…
Container Storage Interface (CSI)
Decoupling storage providers from Kubernetes — the plugin architecture A CSI driver deploys two components in the cluster: CSI drivers don't talk to the K8s…
Proxmox Architecture
Open-source virtualization management — KVM VMs and LXC containers on Debian Each Proxmox KVM VM is ultimately a QEMU process running on the host. Proxmox…
VM Lifecycle & Networking
Creating, migrating, and connecting VMs in Proxmox Proxmox reads /etc/pve/qemu-server/<vmid>.conf qemu-server translates config into qemu-system-x86_64 args
Storage & High Availability
Storage backends, ZFS, Ceph, clustering, and automatic failover Proxmox supports many storage backends. The choice determines whether you get snapshots, thin…
