Tutorials covering the tools that developers use every day — version control, editors, build systems, package managers, containers, and the command-line utilities that make work faster. Each chapter is standalone, built around real examples and verified commands.
The Compose file is not a single static document. It is a base configuration, and it can be layered with override files, scoped with profiles, and merged into a final model that Compose resolves before starting any container. This layering is what allows a single repository to serve development, testing, and production without duplicating the…
A microservices application has several services, and each one has its own codebase, its own dependencies, and its own runtime. Running the whole stack locally is the daily reality of a developer working on one of those services. The naive approach is to run the service under development with a local toolchain and run the…
Every container writes to stdout and stderr. That much is universal. What happens next depends entirely on the logging driver. The driver decides where the output goes, how it is formatted, and how long it is kept. Docker ships with a set of built-in drivers that cover the common cases: the local JSON files, the…
A single container’s logs are accessible with docker logs. A hundred containers across ten hosts are not. The logs are scattered across the machines, and the search requires the SSH into each one. The centralized log aggregation solves the problem: the container logs are shipped to a central system, indexed, and searchable from the single…
A running container is not the same as a healthy container. The docker ps shows the Up status, but it does not show the CPU spikes, the memory growth, the network saturation, or the disk I/O. The monitoring stack answers the question the docker stats cannot: what is the trend, what is the historical baseline,…
The Docker daemon is the background process that builds, runs, and manages every container on the host. It listens on the socket, pulls the images, starts the containers, and writes the logs. By default, it works well enough for the basic use, but the production environment demands the control over the logging, the storage, the…
A Docker host accumulates garbage. The stopped containers linger, the dangling images pile up, the build cache grows, and the unused volumes sit idle. The disk fills slowly, and then suddenly the builds fail, the pulls fail, and the daemon stops responding. The cleanup is not a one-time task; it is the ongoing maintenance. The…
A Docker image is not a single artifact. It is a stack of layers: a base operating system with its package manager, a language runtime with its dependency tree, and the application code itself. Each layer carries its own inventory of packages, and any one of them can contain a known vulnerability. Scanning exists to…
A container is a process, not a virtual machine. It runs directly on the host kernel, and the kernel does not distinguish between a process running in a container and a process running on the host. The only thing separating them is a set of kernel features: namespaces, cgroups, and capabilities. Capabilities are the most…
Capabilities restrict which operations a process may perform. Seccomp restricts which system calls a process may make. Linux Security Modules go one layer deeper: they restrict which resources a process may touch, even when the operation is permitted and the syscall is allowed. AppArmor does this by matching file paths and network rules. SELinux does…