Seven tracks

Each one is prose with a live builder and a live runtime beside it. Every claim a lesson makes is a build you can run, and every byte it shows you is one this browser computed rather than measured.

• What an image is

  0/2

  What is actually inside the thing you just pushed?

  Layers as filesystem diffs rather than folders, whiteouts and why deleting a file makes the image bigger, real digests and the deduplication that falls out of them, tags against digests, and the config — the half of an image that is metadata rather than filesystem.

  • A layer is a diff, not a folder7 min
  • Deleting a file makes the image bigger8 min

• The cache

  0/2

  Which of these instructions is about to run again?

  The invalidation rule, exactly: parent image, instruction text, and for COPY and ADD a checksum of the sources. Then instruction ordering as the whole discipline, where COPY . . belongs, .dockerignore as a cache tool rather than a size tool, and why your CI never hits the cache.

  • The rule, exactly9 min
  • Three things that do not invalidate the cache7 min

• Size

  0/2

  Where did the one-point-four gigabytes come from?

  The base image decision made honestly, multi-stage and what the final stage is allowed to contain, package manager residue, and the secret that was fetched in layer three and deleted in layer five — along with the audit that finds it.

  • The base image decision, honestly7 min
  • Ship the output, not the toolchain8 min

• PID 1 and signals

  0/1

  What does your container do when it is asked to stop?

  exec form against shell form, forwarding SIGTERM, reaping and the zombie pile in a long-lived container, grace periods, and the container that takes ten seconds to stop — and why the orchestrator gave up on it.

  • Your process is PID 1, and it owes the system something9 min

• Isolation

  0/1

  What is a container hiding, and what is it sharing?

  Each namespace and what it hides, what stays shared with the host, root in the container against root on the host, user namespaces, a read-only rootfs, and dropping capabilities instead of running as root.

  • What a container is hiding, and what it is sharing8 min

• Limits

  0/1

  Was that a crash or was it the OOM killer?

  memory.max and the kill that looks like a segfault at three in the morning, cpu.max and the throttling that looks like a slow dependency, pids.max, and requests that are not limits.

  • Three limits, and three failures that do not look like limits8 min

• Reading a generated Dockerfile

  lives elsewhere

  What will this build, and what will it ship?

  The track the rest exists for. You are handed the Dockerfile and compose file an agent wrote for a stated service, and asked what it rebuilds, what it weighs, what is inside it that should not be, and what it does when stopped. Then you build it and watch.

  It lives at /audit

9 lessons. The reading track has none of its own — it is the whole of /audit.