Limits
Three limits, and three failures that do not look like limits
`memory.max` and the kill with no stack trace, `cpu.max` and the throttling that reads as a slow dependency, `pids.max`, and why a request is not a limit.
The other half of what a container is
Namespaces decide what a process can see. A cgroup decides what it can use. Both are ordinary kernel features and neither of them is the container — the container is the pair of them applied to a process.
There are dozens of cgroup knobs and three of them account for almost every production surprise.
Dockerfile
- 1
- 2
Layers
Nothing has been built yet. Press Build and the layers, the digest and the cache ledger appear — not before.