Tutorials covering the tools that developers use every day — version control, editors, build systems, package managers, containers, and the command-line utilities that make work faster. Each chapter is standalone, built around real examples and verified commands.
Standard containers share the host kernel. A kernel vulnerability, a misconfigured capability, or an escape exploit in one container can compromise the entire host. Seccomp, AppArmor, and SELinux reduce the attack surface, but they are policies layered on top of the same kernel—they do not change the fundamental architecture. gVisor and Kata Containers take two…
The Docker CLI is a client. When you run docker ps or docker run, the CLI does not execute the operation itself. It sends an HTTP request to the Docker daemon (dockerd) over a socket, receives the response, and formats it for the terminal. The API that the CLI uses is the Docker Engine API,…
Docker’s official SDKs exist because the Docker CLI is not the only way to talk to the daemon. The Docker Engine API is a RESTful HTTP interface, and the SDKs are language-specific clients that wrap it. The Python SDK (docker-py, installed as docker) and the Go SDK (github.com/docker/docker/client) are the two official options, and they…
Docker’s CLI plugin system is the modern, supported way to extend the docker command with new subcommands. Unlike the deprecated engine plugin system, which required registering a daemon-side plugin with a manifest and Unix socket, a CLI plugin is simply an executable binary that Docker discovers and invokes. The naming convention is the entire contract:…
A database container is not like a web server container. The web server is stateless—kill it, restart it, and it serves the same content. The database holds state, and the entire value of the containerization exercise depends on that state surviving. Docker’s default filesystem is ephemeral: when the container is removed, everything written inside it…
A reverse proxy sits between the public internet and your application containers. It terminates TLS, routes requests by hostname or path, and forwards traffic to the appropriate backend. Containerizing it means the proxy itself becomes a service in the Compose stack, with its configuration mounted or baked into the image, and its lifecycle managed alongside…
A Node.js application containerized naively produces an image that is both enormous and insecure. A single-stage build with COPY . . followed by npm install bakes every devDependency—TypeScript, Jest, ESLint, Webpack—into the runtime image, along with the shell and package manager that an attacker can use after a breach. The official node:20 image is built…
A Python web application in a container is only as good as its process model. Running uvicorn main:app inside a Docker image works for development, but it leaves every CPU core beyond the first idle and provides no process supervision when a worker crashes. The production pattern pairs a process manager (Gunicorn) with an async…
Compiled languages produce a single artifact that either runs or does not. There is no interpreter, no virtual environment, no dependency resolution at startup. This property makes them ideal candidates for minimal container images: the build stage can be heavy, but the runtime stage needs only the binary and whatever shared libraries it dynamically links…
A Dev Container is not a production image with debugging tools bolted on. It is a separate artifact defined by a structured metadata file—devcontainer.json—that tells the editor how to build, start, and configure a containerized workspace . The distinction matters: production images should be minimal and hardened; development images should include compilers, debuggers, language servers,…