Containers on Linux

First containers 5 topics

• Entry check: are you ready for containers?
  A forty-five minute check of the Linux ideas this course builds on: processes, ports, services, logs, permissions and files, with a pointer to what to revisit for each.
• What a container really is
  A container as an isolated process: namespaces, cgroups and an image as root file system, shared kernel versus a virtual machine, image versus container, docker run with…
• Running services: ports, settings and logs
  Publishing a port with -p HOST:CONTAINER, passing settings with -e, reading output with docker logs, looking inside with docker exec and docker inspect, stop and start…
• Images, tags and registries
  Image names (registry, repository, tag, digest), why a tag moves, pulling and listing, layers, choosing a small base, docker history, docker tag, docker rmi and what…
• Data that survives: volumes and bind mounts
  The writable layer and why it is lost, named volumes for databases, bind mounts for configuration and a live site, read-only mounts, deleting volumes safely, and backing…

Building images 4 topics

• Your first Dockerfile
  A Dockerfile as a recipe (FROM, COPY, RUN, WORKDIR, ENV, EXPOSE, CMD), RUN at build versus CMD at start, docker build -t NAME:TAG, running the built image, reading build…
• Layers, cache and the build context
  Layers and the build cache, why order matters (dependencies first, code last), the build context and .dockerignore, why a secret copied into an image stays in it, and…
• Smaller and safer images
  Why images grow, multi-stage builds with FROM AS and COPY --from, small final stages, running as a non-root USER, HEALTHCHECK, and auditing which containers run as root.
• Tags, releases and rollback
  A release as a version tag, upgrading by creating a new container, rolling back by running the old tag, why latest is a trap, pinning by tag or digest, promoting with a…

Connecting and limiting 3 topics

• Container networks: names, ports and isolation
  Each container's own address and localhost, the default bridge versus user-defined networks with name lookup, publishing only what outsiders must reach, keeping a…
• Compose: several containers, one file
  A Compose file with services, ports, environment, volumes and dependson, the daily commands (up -d, ps, logs, down, down -v, config), the project name, recreating only…
• Limits, restarts and self-healing
  Memory, processor and process limits as cgroup settings, OOM kills (exit 137, OOMKilled), measuring before setting, restart policies (no, on-failure, always…

Operating and securing 3 topics

• Troubleshooting containers
  Reading a container's state, exit code, log and settings in order, the meaning of exit codes (0, 1, 125, 126, 127, 137, 139, 143), start-time errors (executable not…
• Container security: least privilege
  Least privilege for containers (non-root, read-only, dropped capabilities, no new privileges, limits), the options that remove walls (--privileged, docker.sock, host…
• Housekeeping: disk, prune and logs
  Where Docker's disk space goes (containers, images, volumes, build cache, logs), docker system df, the prune commands and which of them can delete data, log limits with…

Infrastructure behind containers 4 topics

• Containers on the host: namespaces, cgroups and the runtime
  The parts of the container host (client, daemon, containerd and runc, namespaces, cgroups, image store), a card for each with role, resource profile, failure modes…
• Images, registries and the supply chain
  The parts of an image's journey (Dockerfile, base image, layers and manifest, registry, tag and digest, scanner), a card for each, the path of one release from code to a…
• Networking and storage for containers
  The parts of container networking and storage (bridge network, published ports and address translation, embedded DNS, volumes, bind mounts, the storage driver), a card…
• From one host to many: failure, recovery and orchestration
  A failure table for the container host, a drill, a handover built from commands, a restore test for a volume, capacity arithmetic, and the limits of one host against an…

Interview ready 2 topics

• Interview ready: images, containers and data
  The questions people really ask about containers versus virtual machines, images, Dockerfiles, caching, size and safety, volumes and troubleshooting, with model answers…
• Interview ready: networks, Compose, limits and security
  The questions people really ask about container networks, Compose, limits and restarts, security, disk use and the limits of one host, with model answers, strong and…

The booking system in containers

A Dockerfile that builds a small non-root image with a health check, a compose file that runs the application and its database on a private network with limits and restart policies, and the commands that prove each part works.

The operations pack

A troubleshooting log of three faults (a missing setting, a port clash, an out-of-memory exit) with the evidence from ps, logs and inspect, a hardening checklist, and a clean-up routine with log limits.

The container host map and handover

A card for each part, the capacity arithmetic with assumptions, a failure table with one drill, a restore test of a volume and a one-page handover.

Why take this course

• Trace a failing container from the exit code to the cause
• Know what is in force, not just what you typed
• Ship and roll back without a night of panic

You will build

• The booking system in containers
• An operations pack
• A container host map and handover

What you can do afterwards

• Run containers with confidence
• Explain your choices and their risks
• Answer container interview questions with specifics