Containers look like lightweight VMs, but they’re really just processes wrapped in namespaces and cgroups. We unpack mount, PID, network, UTS, IPC, user, and cgroup namespaces, trace how runtimes like containerd wire them together, and explore the failure modes every SRE should know.
Namespaces are the unsung kernel feature behind every container runtime. This post walks through the eight namespace types, how they appear in the kernel, and how Docker, Kubernetes, and runc compose them into the isolation boundary you trust in production.
Learn how to apply the USE method to systematically diagnose performance bottlenecks in production systems by checking utilization, saturation, and errors for every resource.
Compare Linux’s two dominant async I/O architectures, io_uring and epoll, with kernel internals, real benchmarks, and patterns drawn from production systems.
Build a working container runtime in roughly 300 lines of Go, using Linux namespaces and cgroups. A side project that signals real systems engineering chops on a CV.