Key point: A web request travels through DNS (name to IP), TCP (connection), TLS (encryption), and HTTP (request/response), and the browser is the environment that orchestrates all four. Every concept in this cheatsheet maps to one stage of that journey. The Internet vs the Web Term Meaning Internet The global network of interconnected networks Web…
A packet that leaves a container and reaches the internet passes through at least four distinct processing stages, and each stage is implemented by a different kernel subsystem. The veth pair is the virtual cable between the container’s network namespace and the host’s. The Linux bridge is the switch that connects the host-side veth to…
Docker’s persistence model creates a specific backup problem: named volumes and bind mounts hold the data that matters, but the container’s writable layer is disposable, and the image is reproducible from a registry. A backup strategy that copies the entire /var/lib/docker directory is fragile and often inconsistent; a strategy that stops the stack and tars…
Traefik is a reverse proxy that discovers Docker containers through the Docker socket and routes traffic to them based on labels attached to the container itself. The routing configuration is not a separate file that must be edited when a service is added; it is a set of traefik.http.routers.* and traefik.http.services.* labels on the container,…
GitOps is a deployment model in which the desired state of the infrastructure is stored in a Git repository, and a controller continuously reconciles the running state with the committed state. The model has two implementations that are often confused: pull-based reconciliation, where an in-cluster agent watches Git and applies changes, and image-update automation, where…
The choice between DinD and DooD is a choice about where the Docker daemon lives and who controls it. Docker-in-Docker runs a nested daemon inside the CI job container, giving each job its own isolated Docker environment with its own image cache, network, and storage. Docker-outside-of-Docker mounts the host’s Docker socket into the job container,…
unsafe is a promise, not a permission. The keyword tells the compiler that the programmer has verified a set of conditions that the compiler cannot verify, and the compiler responds by allowing a small set of operations it otherwise forbids. It does not disable the borrow checker, it does not turn off type checking, and…
Tauri is not Electron with a Rust backend bolted on. It is an application toolkit that composes a Rust core process with the operating system’s native WebView, and the architectural difference determines the binary size, the memory footprint, and the security model. The core process is a compiled Rust binary that has full access to…
Rust’s desktop GUI story has two dominant approaches, and the distinction is architectural. egui is an immediate-mode GUI library: on every frame, the application describes the entire UI from its state, and egui renders it and handles input in the same pass. iced is a retained-mode framework modeled on The Elm Architecture: the application defines…
Ratatui is an immediate-mode rendering library for terminal user interfaces. The distinction from a retained-mode GUI framework is architectural: on every frame, the application must rebuild and render the entire widget tree, and Ratatui diffs the result against the previous frame to determine which terminal cells need updating . This model gives the developer complete…