Free chapter — no signup required

Containerization, Wasm & Kubernetes

Docker Internals: Peeking Under the Hood

Introduction: It's Not Magic, It's Linux

Image Layers: The Union Filesystem

Multi-Stage Builds: The "Builder" Pattern

Distroless Images: The Ultimate Minimalism

BuildKit: The Modern Docker Builder

ENTRYPOINT vs. CMD: The Eternal Confusion

Signals Handling and the PID 1 Problem

The Container Runtime Ecosystem

Introduction: What Actually Runs My Container?

OCI: Speaking the Same Language

The Standard Layer Cake

The Security Problem: Shared Kernels

Sandboxed Runtimes: gVisor and Firecracker

RuntimeClass: Selecting a Runtime in Kubernetes

WebAssembly (Wasm): The Next Wave of Cloud Compute

Introduction: Beyond the Browser

The Missing Link: WASI

Wasm vs. Containers: Architecture Deep Dive

Wasm on the Edge: The Speed Advantage

The Developer Experience: Runtimes and Frameworks

Unikernels: The Ultimate Specialization

Introduction: The Swiss Army Knife Problem

The Concept: LibraryOS

What is a Unikernel?

Unikernels vs. Containers vs. VMs

The Benefits: Speed, Size, and Efficiency

The Ecosystem: MirageOS and Unikraft

Unikernels in Practice: Where They Fit

Kubernetes Primitives: The Building Blocks

Introduction: The LEGO Bricks of Kubernetes

Pods: The Atomic Unit

Pod Lifecycle and Probes

Services: Stable Networking for Unstable Pods

Service Types: Exposing Your App

Deployments: Managing Stateless Apps

Rolling Updates: Zero Downtime

ConfigMaps and Secrets: Decoupling Config from Code

Consuming ConfigMaps and Secrets

Workload Management: Beyond Standard Deployments

Introduction: Cattle vs. Pets Revisited

StatefulSets: When Identity Matters

StatefulSets: Ordered Scaling and Update Behavior

DaemonSets: One Pod Per Node

Jobs: Run-to-Completion Tasks

CronJobs: Scheduled Tasks

Pod Disruption Budgets: Protecting Availability During Maintenance

Scheduling Math: The Invisible Hand of Kubernetes

Introduction: The Ultimate Game of Tetris

Requests vs. Limits: The Foundation of All Scheduling Math

Bin Packing: Filling the Boxes Efficiently

The Fairness Problem: Dominant Resource Fairness (DRF)

Quality of Service (QoS) Classes

Defining the Three QoS Classes

PriorityClasses and Preemption

Kubernetes Networking: Connecting the Dots

Introduction: The "Flat Network" Challenge

CNI Plugins: The Plumbers of Kubernetes

Networking Modes: Overlay vs. Direct Routing

DNS within Kubernetes: The Internal Phonebook

Ingress: The Front Door

The Gateway API: Ingress Evolved

Network Policies: The Firewall for Pods

Kubernetes Storage: Persisting the Data

Introduction: The Problem with Ephemeral Containers

The Dynamic Duo: PV and PVC

StorageClasses: Automating the Magic

Reclaim Policies: What Happens When You Delete?

The Plumbing: Container Storage Interface (CSI)

Volume Snapshots and Ephemeral Volumes

The Kubernetes Control Plane: The Cluster's Brain

Introduction: The "Master" Nodes

The API Server: The Front Door

The 3 Gates of the API Server

Etcd: The Cluster's Memory

The Controller Manager: The State Reconciler

The Scheduler: The Dispatcher

Extending Kubernetes: Teaching an Old Dog New Tricks

Introduction: When standard objects aren't enough

Custom Resource Definitions (CRDs): Teaching new words

Operators: The "Human" in the Loop

Deep Dive: Level-Based Triggering

Building Operators: The Tech Stack

Webhooks: Intercepting Requests

Aggregated API Servers (Advanced)

Helm: The Kubernetes Package Manager

Introduction: Escaping "YAML Hell

Core Concepts: Charts, Values, and Releases

How Helm Works: The Templating Engine

Artifact Hub and Chart Repositories

Overriding Values: Customizing a Release

Anatomy of a Helm Chart Directory

Operator Development: Writing Robust Controllers

Introduction: Automating the Operator

The Toolkit: Kubebuilder and Operator SDK

Project Structure: Where Code Lives

The Reconciliation Loop: The Core Engine

Handling "Not Found" Errors

Idempotency: The Golden Rule

Status Updates: Communicating with Users

Finalizers: Handling Deletion

Advanced Scheduling: Mastering Placement

Introduction: Beyond Random Placement

Taints and Tolerations: The Bouncer

Node Affinity: The Magnet

Pod Affinity and Anti-Affinity: Relative Placement

Topology Spread Constraints: The Modern HA

Multi-Cluster Architecture: Scaling Beyond Limits

Introduction: Why One Cluster is Not Enough

Federation: The "Meta-Cluster" Concept

GitOps Architectures: Hub-and-Spoke vs. Independent

Service Mesh Federation: Connecting Services Across Clusters

Cluster API and Fleet Provisioning

Kubernetes Security Internals: Identity and Policy

Introduction: The Security Layers

Authentication: The Missing User Database

Identity Brokers: Dex and Keycloak

RBAC Evaluation Logic

Pod Security: The Evolution from PSP to PSS

Pod Security Standards (PSS) Levels

Pod Security Admission (PSA) Modes

Resource Tuning: Finding the Goldilocks Zone

Introduction: The Price of Performance

Requests vs. Limits: The Contract

The Consequences of Hitting Limits

Deep Dive: CFS Quota and CPU Throttling

Quality of Service Classes: How Kubernetes Prioritizes Eviction

Autoscaling Wars: VPA vs. HPA

Setting the Right Values: A Practical Framework

Kubernetes Networking Internals: The Plumbing

Introduction: How Services Actually Work

Kube-Proxy Modes: Iptables vs. IPVS

The Packet Flow: A Service Request's Journey

CNI: The Plugin That Wires Pods Together

Debugging CNI Failures

Etcd Operations at Scale: Keeping the Brain Healthy

Introduction: The Sensitive Brain

Defragmentation: Cleaning Up the Holes

Member Management: Surgery on the Cluster

Disaster Recovery: Snapshots

Monitoring Etcd Health: Knowing Before It Breaks

Advanced Debugging: CSI for Kubernetes

Introduction: When "Kubectl Logs" Isn't Enough

Kubectl Debug: The Ghost in the Shell

Profiling: X-Raying the CPU with pprof

Debugging DNS: Tracing the Infinite Loop

Network Packet Inspection with tcpdump and Ephemeral Containers

Docker Compose: Orchestrating Local Environments

Introduction: Escaping the CLI Jungle

The Compose File Structure

Networking in Compose

Volumes: Persistent Storage and Live Reloading

Essential Compose Commands

K8s Dashboarding & Tooling: The User Experience

Introduction: Escaping the CLI Limitations

The Official Kubernetes Dashboard

Lens: The Kubernetes IDE

K9s: The Terminal Power User's Tool

Octant: Visualizing Relationships

Krew: The Plugin Manager

Virtual Clusters (vCluster): Kubernetes Inception

Introduction: The Tenancy Dilemma

Architecture: Control Planes Inside Control Planes

The Syncer: The Magic Bridge

Why Use vCluster? Key Use Cases

vCluster vs. Alternatives: Choosing the Right Tool

Service Mesh Internals: The Engine Room

Introduction: The Universal Data Plane

Envoy Internals: The Russian Doll Model

Deep Dive: The Filter Chain

WASM Extensions: Safer, Faster Customization

Sidecar Injection: The Mutating Webhook

Networking Redirection: The iptables Magic

Debugging Injection and Mesh Failures

KEDA: Autoscaling Beyond CPU

Introduction: The "CPU Trap

KEDA Architecture: The Metrics Proxy

The Magic of "Scale to Zero

The Custom Resource: ScaledObject

Authentication: TriggerAuthentication

Runtime Classes: Building Secure Sandboxes

Introduction: Is Docker Secure Enough?

Sandboxed Runtimes: gVisor and Kata Containers

RuntimeClass: The Selector Mechanism

Assigning Pods to Runtimes

K8s API Aggregation Layer: Beyond CRDs

Introduction: When CRDs Aren't Enough

Architecture: The API Proxy

The Canonical Example: Metrics Server

The Glue: APIService Resource

Authentication Delegation: Trusting the Proxy

CRD vs. Aggregation Layer: Choosing the Right Tool

This is one of 18 chapters

Every chapter is free — Kubernetes, Terraform, SRE, distributed systems, and more — with fast daily review built in.