Containers

One endpoint being administratively up is insufficient when its paired endpoint is down.

A veth pair carries frames between two endpoints; routing supplies their meaning

A veth pair consists of two interconnected virtual Ethernet devices. A frame transmitted through one is delivered to the other, where the receiving network stack or bridge handles it. The two ends can reside in separate Linux network namespaces, making the pair useful for container networking. Creating the pair supplies a link; addresses, routes, bridge membership, forwarding, and access policy are additional configuration. ...

The process cannot write the root filesystem or change to UID zero, but can use its explicitly writable volume.

Security context defines constraints that need runtime evidence

A Kubernetes securityContext configures process identity and selected operating-system constraints. It can reduce what a compromised application is permitted to do, but it does not establish a complete security boundary by itself. Start with the operations the application actually needs, configure the appropriate fields, and test both a permitted operation and a forbidden one in the resulting container. ...

A digest and cryptographic signature attached to a container image.

Signed images prove who built them

A container image reference is a mutable pointer; a digest is immutable. Signing ties a digest to a key, so a verifier can ask who produced these exact bytes before anything runs them. That is the question registries and manifests cannot answer, because they tell you where bytes came from, not who made them. ...

One fixed base supports different builds, configurations, and writable container states.

A pinned base fixes one input; the release needs the rest

Pinning a container base by digest fixes the referenced image object instead of relying on a movable tag. That removes one source of unexpected build changes, but it does not make every derived image or running instance identical. Application source, build arguments, fetched dependencies, target platform, runtime configuration, and persistent data can still change what gets built and how it behaves. ...

A failed preparation retries before transformation and the application; Never policy ends a separate Pod.

Regular init containers establish startup prerequisites

A regular init container performs setup before a Pod’s application containers start. It has its own command, image and filesystem view, and can mount a volume that the application later reads. This separates a prerequisite from the main process, but does not make arbitrary setup safe or automatically bounded. Design the step around its actual retry behavior and the lifetime of its output. ...

Two containers see separate process and network spaces while sharing the daemon-side Linux kernel.

A container combines process isolation with a shared Linux kernel

A conventional Linux container runs processes using the daemon host’s Linux kernel while providing selected isolated views through namespaces. Image files supply a userspace environment; they do not boot a separate kernel for each container. On Docker Desktop for macOS, the daemon and Linux containers run inside a Linux virtual machine, so the shared kernel is that VM’s kernel, not the macOS kernel. ...

One workload encounters CPU throttling, a task-count ceiling, and a separately enforced memory budget.

cgroup v2 enforces different budgets with different failure modes

cgroup v2 organizes resource control in a unified hierarchy. A workload’s processes can share aggregate budgets, with limits inherited through the hierarchy rather than applied only to one particular PID. CPU bandwidth, memory usage, and task count are separate controllers with different enforcement behavior. Reading the actual cgroup files and failure counters is more useful than treating every configured limit as the same kind of hard stop. ...

The final stage contains the selected executable; its runtime dependencies still determine whether it can start.

Multi-stage builds need a tested runtime boundary

A multistage Dockerfile can compile software in one stage and copy selected outputs into another stage that becomes the runtime image. The final stage inherits its own base and the files explicitly copied into it, rather than automatically inheriting the builder’s compiler, source tree, and package caches. This creates a useful boundary, but the author must still identify everything the program needs when it executes. ...