A practical guide to layering eBPF programs on top of seccomp filters for fine-grained syscall control inside rootless Podman containers. Walks through architecture, BPF CO-RE programs, seccomp notifier hooks, and production patterns.
How gVisor reimplements the Linux kernel in user space to safely sandbox containers, and what the trade-offs look like in real deployments.
gVisor moves the Linux kernel into userspace to sandbox containers at the syscall boundary, trading raw throughput for a dramatically smaller attack surface.
Containers look like lightweight VMs, but they’re really just processes wrapped in namespaces and cgroups. We unpack mount, PID, network, UTS, IPC, user, and cgroup namespaces, trace how runtimes like containerd wire them together, and explore the failure modes every SRE should know.
Namespaces are the unsung kernel feature behind every container runtime. This post walks through the eight namespace types, how they appear in the kernel, and how Docker, Kubernetes, and runc compose them into the isolation boundary you trust in production.