Seven tracks

Each one is prose with a live builder and a live runtime beside it. Every claim a lesson makes is a build you can run, and every byte it shows you is one this browser computed rather than measured.

• What an image is

  Lands in M2

  What is actually inside the thing you just pushed?

  Layers as filesystem diffs rather than folders, whiteouts and why deleting a file makes the image bigger, real digests and the deduplication that falls out of them, tags against digests, and the config — the half of an image that is metadata rather than filesystem.

• The cache

  Lands in M2

  Which of these instructions is about to run again?

  The invalidation rule, exactly: parent image, instruction text, and for `COPY` and `ADD` a checksum of the sources. Then instruction ordering as the whole discipline, where `COPY . .` belongs, `.dockerignore` as a cache tool rather than a size tool, and why your CI never hits the cache.

• Size

  Lands in M3

  Where did the one-point-four gigabytes come from?

  The base image decision made honestly, multi-stage and what the final stage is allowed to contain, package manager residue, and the secret that was fetched in layer three and deleted in layer five — along with the audit that finds it.

• PID 1 and signals

  Lands in M4

  What does your container do when it is asked to stop?

  `exec` form against shell form, forwarding `SIGTERM`, reaping and the zombie pile in a long-lived container, grace periods, and the container that takes ten seconds to stop — and why the orchestrator gave up on it.

• Isolation

  Lands in M4

  What is a container hiding, and what is it sharing?

  Each namespace and what it hides, what stays shared with the host, root in the container against root on the host, user namespaces, a read-only rootfs, and dropping capabilities instead of running as root.

• Limits

  Lands in M5

  Was that a crash or was it the OOM killer?

  `memory.max` and the kill that looks like a segfault at three in the morning, `cpu.max` and the throttling that looks like a slow dependency, `pids.max`, and requests that are not limits.

• Reading a generated Dockerfile

  Lands in M6

  What will this build, and what will it ship?

  The track the rest exists for. You are handed the Dockerfile and compose file an agent wrote for a stated service, and asked what it rebuilds, what it weighs, what is inside it that should not be, and what it does when stopped. Then you build it and watch.

  It lives at /audit

0 lessons built so far. The rest land with their milestones.