The Open Container Initiative (OCI) is the governance body that turned containers from a Docker-specific technology into an open industry standard. Before OCI, the container ecosystem was locked into Docker’s proprietary formats: an image built by Docker ran on Docker, a registry built by Docker served Docker, and an alternative runtime had to reverse-engineer the…
The container runtime landscape is not a single tool but a layered ecosystem, and understanding the alternatives requires understanding what problem each one solves. CRI-O and Podman are both Red Hat-originated projects that emerged from the same architectural insight: Docker’s monolithic daemon was too much for most use cases, and the OCI specifications made it…
Podman Desktop is the graphical interface that turns Podman from a command-line tool into a complete development environment. It installs and configures Podman, provides a dashboard for containers, images, pods, and volumes, and integrates with Kubernetes through Kind, Minikube, and OpenShift . The tool is available on Linux, macOS, and Windows, and it joined the…
Standard containers share the host kernel. A kernel vulnerability, a misconfigured capability, or an escape exploit in one container can compromise the entire host. Seccomp, AppArmor, and SELinux reduce the attack surface, but they are policies layered on top of the same kernel—they do not change the fundamental architecture. gVisor and Kata Containers take two…
The Docker CLI is a client. When you run docker ps or docker run, the CLI does not execute the operation itself. It sends an HTTP request to the Docker daemon (dockerd) over a socket, receives the response, and formats it for the terminal. The API that the CLI uses is the Docker Engine API,…
Docker’s official SDKs exist because the Docker CLI is not the only way to talk to the daemon. The Docker Engine API is a RESTful HTTP interface, and the SDKs are language-specific clients that wrap it. The Python SDK (docker-py, installed as docker) and the Go SDK (github.com/docker/docker/client) are the two official options, and they…
Docker’s CLI plugin system is the modern, supported way to extend the docker command with new subcommands. Unlike the deprecated engine plugin system, which required registering a daemon-side plugin with a manifest and Unix socket, a CLI plugin is simply an executable binary that Docker discovers and invokes. The naming convention is the entire contract:…
A database container is not like a web server container. The web server is stateless—kill it, restart it, and it serves the same content. The database holds state, and the entire value of the containerization exercise depends on that state surviving. Docker’s default filesystem is ephemeral: when the container is removed, everything written inside it…
A reverse proxy sits between the public internet and your application containers. It terminates TLS, routes requests by hostname or path, and forwards traffic to the appropriate backend. Containerizing it means the proxy itself becomes a service in the Compose stack, with its configuration mounted or baked into the image, and its lifecycle managed alongside…
A Node.js application containerized naively produces an image that is both enormous and insecure. A single-stage build with COPY . . followed by npm install bakes every devDependency—TypeScript, Jest, ESLint, Webpack—into the runtime image, along with the shell and package manager that an attacker can use after a breach. The official node:20 image is built…