“containers”
The Container Security Model: What Is and Is Not Isolated
Containers share one host kernel, so isolation is a bundle of kernel features, not a wall. NIST SP 800-190 frames the model — this post maps each layer to what it really isolates and how to harden it.
Linux Namespaces: The Isolation Primitive Behind Containers
What Linux namespaces actually do, the eight namespace types, how to inspect them on a live system, and why they make containers fundamentally different from virtual machines.
Docker Multi-Stage Builds: Smaller Images From First Principles
How multi-stage Docker builds shrink images, cut attack surface, and improve caching — with real examples for Go, Node.js, and Python.
Docker Volumes vs Bind Mounts vs tmpfs: Where Your Data Should Live
Containers are ephemeral — your data shouldn't be. Compare Docker volumes, bind mounts, and tmpfs mounts, and learn exactly when to use each.
Docker Restart Policies Explained: no, always, on-failure, unless-stopped
When should Docker restart your container? A practical guide to the four restart policies and how to choose the right one for each workload.
Containers vs Virtual Machines: Architecture and Trade-offs
A clear architectural comparison of containers and virtual machines: what they share, where they diverge, and how to choose between them.
Kubernetes for Frontend Teams: A Gentle Introduction
A beginner-friendly, code-first tour of Kubernetes for frontend engineers: core objects like Pods, Deployments, Services and Ingress, plus a complete YAML bundle to deploy a React SPA and API with health checks.
Docker for Web Developers: Images That Ship
A code-first walkthrough of writing Dockerfiles for web apps that actually ship: multi-stage builds, non-root users, .dockerignore, secrets, BuildKit caching, and docker compose for local dev.