Packaging: containers and images

the process thinks it has its own machine, and on the host it is one ordinary PID among hundreds.

Container

you ship a tarball of a whole filesystem plus a line saying what to run, and the same bytes go to every environment.

Container image

changing one line at the top of the build file invalidates every layer beneath it and the build goes from nine seconds to four minutes.

Image layer

the build was instant on your laptop and takes six minutes on the runner, because the runner starts empty every time.

Build cache

a vulnerability was reported in a library you have never imported, because it came in the operating system underneath your code.

Base image

the compiler, the test framework and the whole toolchain are used in the build and then thrown away, and the shipped image contains one binary.

Multi-stage build

you shell into the container to debug it and there is no shell, because the image contains your binary and its libraries and nothing else.

Distroless image

the container starts a shell that starts your process, so signals stop at the shell and nothing ever shuts down cleanly.

Entrypoint

the shutdown signal is delivered and ignored, and every rollout takes exactly thirty seconds per pod before something kills it.

PID 1 problem

two nodes ran what the manifest called the same version and behaved differently, because someone had pushed over the tag.

Image tag

the deployment names a sha256 hash instead of a version, and there is exactly one set of bytes that could ever satisfy it.

Image digest

the deploy failed at three in the morning because the place you pull images from was rate-limiting you, and it is not your infrastructure.

Container registry

you pushed a fix under the same tag, restarted the workload, and the node kept running the copy it already had.

Image pull policy

something on the node unpacks the image, sets up the namespaces and cgroups, and starts the process — and it is not the orchestrator.

Container runtime

an image built by one tool runs under a different runtime on someone else's cluster, and nobody had to agree on a vendor.

Open Container Initiative

the container sees PID 1, its own network interfaces and its own mount tree, all of which are a partial view of the host's.

Linux namespaces

the process is capped at half a CPU and a gigabyte by the kernel, and it has no idea — it still reports the host's numbers.

cgroups

the container writes a file and it lands in a thin writable layer on top, leaving the image underneath untouched.

Overlay filesystem

the uploaded files were there all afternoon and gone after a restart, because they were written inside the container.

Ephemeral container filesystem

configuration comes from the environment, logs go to stdout, and the same image runs in staging and production unchanged.

Twelve-factor app

the process inside is uid 1000 rather than root, so a container escape lands the attacker as nobody in particular.

Rootless container

someone added one flag to make a mount work, and that container can now reconfigure the host.

Privileged container

the attacker got out of the container onto the node, and from the node to every other tenant's workload on it.

Container escape

the pipeline compares every package in the image against a vulnerability feed and fails the build on anything critical.

Image scanning

a vulnerability was announced on a Friday and you answered 'are we affected' from a file rather than from a week of grepping.

Software bill of materials

you build the same commit twice on different machines and get byte-identical output, timestamps and all.

Reproducible build

the build runs with the network switched off, so anything it needs had to be declared up front.

Hermetic build