Tutorials covering the tools that developers use every day — version control, editors, build systems, package managers, containers, and the command-line utilities that make work faster. Each chapter is standalone, built around real examples and verified commands.
GitOps is a deployment model in which the desired state of the infrastructure is stored in a Git repository, and a controller continuously reconciles the running state with the committed state. The model has two implementations that are often confused: pull-based reconciliation, where an in-cluster agent watches Git and applies changes, and image-update automation, where…
Traefik is a reverse proxy that discovers Docker containers through the Docker socket and routes traffic to them based on labels attached to the container itself. The routing configuration is not a separate file that must be edited when a service is added; it is a set of traefik.http.routers.* and traefik.http.services.* labels on the container,…
Docker’s persistence model creates a specific backup problem: named volumes and bind mounts hold the data that matters, but the container’s writable layer is disposable, and the image is reproducible from a registry. A backup strategy that copies the entire /var/lib/docker directory is fragile and often inconsistent; a strategy that stops the stack and tars…
A packet that leaves a container and reaches the internet passes through at least four distinct processing stages, and each stage is implemented by a different kernel subsystem. The veth pair is the virtual cable between the container’s network namespace and the host’s. The Linux bridge is the switch that connects the host-side veth to…
Docker networking issues are difficult to diagnose from the host because each container has its own isolated network namespace. The eth0 interface, routing table, and socket state that belong to the container are invisible from the host’s default namespace. The tools that solve this problem are nsenter, which lets you enter the container’s network namespace…
Container storage performance is not the same as host storage performance. The storage driver, the writable layer, and the volume configuration all sit between the application and the disk, and each can become the bottleneck that limits throughput or inflates latency. The diagnostic challenge is that the bottleneck is often not the disk itself: a…
Container system call tracing is complicated by two facts that are easy to overlook. First, minimal container images—the ones most likely to be deployed in production—often exclude strace and other debugging tools precisely because they increase the attack surface . Second, strace relies on the ptrace system call, which requires the CAP_SYS_PTRACE capability that Docker…
Distroless images exist to reduce attack surface: they contain the application binary and its runtime dependencies, and nothing else. No shell, no package manager, no curl, no strace. When a distroless container crashes or misbehaves, the standard debugging reflex—docker exec -it <container> /bin/sh—fails because there is no shell to execute . The ephemeral container pattern…
Docker images do not store the original Dockerfile. The image is a stack of layers, and each layer records the instruction that created it, but the full build context—the files that were copied, the arguments passed to docker build—is not preserved in a form that can be reconstructed exactly . Reverse engineering a Dockerfile is…
The CIS Docker Benchmark is a vendor-neutral hardening standard published by the Center for Internet Security, currently at version 1.6.0, with over 100 recommendations organized into seven sections covering the host, daemon, configuration files, images, runtime, operations, and Swarm . Auditors for SOC 2 Type II, PCI DSS 4.0, and FedRAMP accept CIS Docker scores…