• Previous: Container Network
• Next: TBD

In my previous article, I talked about Container Network. Container Network has 5 main network resources and it can be created be close() or unshare() function. In this article, I will talk about Container Security .

Container Security

Container security is a big topic, and the security of a container is largely determined by the architectural characteristics of the container. For example, the container and the host share the Linux kernel, use Namespace to isolate resources, and use shim/runC to start.

With these container architecture features and after you made your choice, as a user of the…

• Previous: Container File System
• Next: TBD

In my previous article, I talked about Container File System. Container uses OverlayFS file system type to reduce the data redundancy between different container images, and it has upper , lower , merged and work four different layers. In this article, I will talk about Container Network .

Understand Container Network Namespace

Regarding Network Namespace, if we take it literally, we know that it is the isolation of the network on a Linux node, but which part of the network resources does it specifically isolate?

Let’s start with Linux Programmer's Manual . In this manual, it has a…

• Previous: Container Memory
• Next: Container Network

In my previous article, I talked about Container Memory. If a container request more memory than its Memory Cgroup limit, the Linux OOM Killer will kill the container process. In this article, I will talk about Container File System .

Understand Container File System

If you run df command inside a container, you will find out that the root (/) file system type is overlay , not the usual ext4 or xfs file system type.

For example:

• Previous: Container CPU
• Next: Container File System

In my previous article, I talked about Container CPU . If more than one containers running on the same hosts, what will happen if they compete for host CPU resources. In this article, I will talk about Container Memory .

Running Container Magically Disappear?

Have you ever ran into this situation when using containers? After a container has been running in the system for a period of time, it suddenly disappeared. Even if you looked at the log file but there’s nothing in it. The container just disappeared.

Most of the time, when a running container that…

• Previous: Container Process
• Next: Container Memory

In my previous article, I talked about two fundamental concepts of containers: Nampespace and Cgroups . We can limit resources through Cgroups . Cgroupscan be divided into many types, such as CPU, Memory, Storage, Network and so on. The computing resource is the most basic resource, and all containers need this resource.

Today, I will dive into container CPU topic.

How Do We Set Container CPUs?

In K8S, you can define the pod/container specs: Request CPU and Limit CPU :

apiVersion: v1
kind: Pod
metadata:
  name: frontend
spec:
  containers:
  - name: app
    image: images.my-company.example/app:v4 …

• Previous: Container Namespace and Cgroups
• Next: TBD

In my previous article, I introduced two very important container concepts: Namespace and Cgroups , Containers from Zero To Hero (2): Namespace and Cgroups. If you haven’t got a chance to check it out, definitely do so. In this article, I will talk about processes running in containers.

The init Process

The ideal state of using containers is to run only one process in one container, but this is sometimes impossible in real world. For example, in addition to the main process in a container, we may also start processes for monitoring or rotate logs.

Once…

• Previous: https://aws.plainenglish.io/container-zero-to-hero-1-basic-container-concept-b78700e2dcb5
• Next: https://aws.plainenglish.io/containers-from-zero-to-hero-3-container-process-5968ab4bbce5

In my previous article, I introduced basic container concepts: Containers from Zero To Hero (1): Basic Container Concepts If you are new to containers, definitely check it out! In this article, I will introduce two very important/foundational container concepts: Namespace and Cgroups .

What Is Namespace

In my previous article, we created a docker image and a running httpd container, let’s use it as an example to see what exactly Namespace is.

PID Namespace:

When we run the following command, we see 5 httpd processes:

$ docker exec 0d0a08ae7de1 ps -ef
UID        PID  PPID…

Part 1 of a series of articles about learning containers and becoming a hero! Next article: https://aws.plainenglish.io/containers-from-zero-to-hero-2-namespace-and-cgroups-eaf587396749

How Popular Are Containers?

Quote from Forbes:

According to a recent Forbes article, container adoption is growing rapidly in the enterprise — much faster than expected. And according to a recent Gartner report, “By 2023, more than 70% of global organizations will be running more than two containerized applications in production, up from less than 20% in 2019.”

As a software engineer, I guess in the past few years, you must have used or heard people mention containers.

Container Is Simple

To be honest, container technology is not complicated at…