Deep Dive
What a Container Actually Isolates, and the Thing It Does Not
The namespaces hide the view and the cgroups cap the usage, and the kernel is shared, so the isolation is a boundary of visibility rather than a wall…
DevOps
The latest Tag That Deployed Yesterday's Build
The image tag never changed, so the node used its cached layer and the new code never ran, and the deploy reported the new version while the container…
Tooling
Reading a Container Image With docker history
Every layer is a transaction and the ledger never lies. docker history shows the secret you deleted, the cache you paid for and the compiler you shipped…
DevOps
Six Months of Running MicroVMs in Production
What broke, what surprised me, and what I would tell someone considering Firecracker for their own platform.
DevOps
A 1.2 GB Image That Should Have Been 90 MB
The image shipped the compiler, the package cache and the build tools to production, because every layer ships.
Deep Dive
Your Container Has Two CPUs and Is Using One Point Three
The container's CPU limit is two cores and its usage never exceeds one point three, yet requests slow down. CFS quota throttles in hundred millisecond…
DevOps
The Thirty Seconds Between SIGTERM and SIGKILL
Kubernetes sends SIGTERM, waits, then sends SIGKILL. Most services lose requests in that window not because shutdown is hard but because nothing ever…
Docker
Why Your Docker Build Reinstalls Every Dependency Every Time
One changed byte early in a Dockerfile throws away everything after it. Here is how the cache key is computed and how to order instructions so it survives.
Docker
exec format error: The ARM64 and AMD64 Mismatch Explained
Your image builds on a Mac and dies in production. What the error means, how to check an image's architecture, and how to build multi arch properly.
Deep Dive
How a MicroVM Boots in Under a Second
Traditional VMs take thirty seconds. Firecracker takes 125 milliseconds. The difference is everything it refuses to do.
Kubernetes
OOMKilled: Why Your Container Died With Clean Metrics
Exit code 137, a memory graph that looks perfectly healthy, and no application error. Here is why your monitoring missed it and how to find the real number.
Kubernetes
CrashLoopBackOff: A Complete Diagnostic Flowchart
CrashLoopBackOff is not an error, it is a symptom with about nine distinct causes. Here is how to identify which one you have in under three minutes.