Containers

A container image is a read-only filesystem plus the metadata that says how to start it; a container is one running instance of that image, isolated by the host kernel’s namespaces and cgroups rather than by a hypervisor. Docker is the toolchain most teams meet first, but the pieces underneath it are separate and swappable: the Docker CLI talks to a daemon, which delegates to a container runtime — containerd in a default install — which in turn calls a low-level OCI runtime to create the process.

This section holds two pages.

Dockerfile explains the instructions that build an image: what separates RUN, CMD and ENTRYPOINT, and why the exec form is the default choice for the last two.

Docker Commands is the working reference — running and inspecting containers, Compose, building, pushing to a registry, and the prune family that reclaims the disk a build habit quietly consumes.

Sidecars and log collection

Containers are frequently deployed in pairs: the application container, and a sidecar alongside it that handles a cross-cutting concern the application should not have to implement. Log shipping is the common case. The application writes to stdout or to a shared volume; the sidecar agent buffers those records, retries with exponential backoff when the destination is unavailable, persists its buffer to disk so a restart does not lose data, routes records by tag, and can fan the same stream out to more than one sink — a search cluster for interactive queries, object storage for retention.

Sharing a volume between containers is what makes the pattern work, and it is the same mechanism that serves the other two reasons to declare a volume: keeping data alive across container replacement, and making it possible to back up.

Further reading

• Docker overview — the architecture of the daemon, images, containers and registries.
• Docker Engine security — the kernel namespaces, cgroups and capabilities a container relies on, and the attack surface of the daemon socket.
• Istio traffic shifting — canary releases at the service-mesh layer, once containers are behind an orchestrator.