React
React Native
Node.js
Python
Rust
PostgreSQL
Solana
Claude
AI Agents
Go
Containers

Containers SME Cookbook

Sections

Container Fundamentals & Docker Core

What a Container Really Is Container Basics Containers vs Virtual Machines OCI Image & Runtime Specs Linux Namespaces & cgroups Immutable Infrastructure Principle Container Fundamentals Best Practices

How the Docker Engine Works Docker Engine Basics Essential CLI Commands Docker Contexts Docker Desktop vs Linux Engine Engine Configuration Docker Engine Best Practices

How a Dockerfile Becomes an Image Dockerfile Basics How Image Layers & Union Filesystems Work Multi-Stage Builds BuildKit & Cache Mounts buildx & Multi-Arch Images `.dockerignore` & Build Context Non-Root Users in Images Distroless & Minimal Bases Dockerfiles Best Practices

Why the Software Supply Chain Matters Registries Basics Tagging & Immutability Registry Authentication cosign & Image Signing SBOM Generation Supply Chain Best Practices

The Compose Model: Declaring a Local Stack Compose Basics Compose for Local Dev Profiles & Overrides Compose vs Kubernetes Gap Compose Best Practices

What Actually Runs Your Containers Runtimes Basics containerd & crictl CRI-O runc & Low-Level OCI Runtimes Best Practices

Dev/Prod Parity as a Mental Model Local Dev Basics Bind Mounts vs Image Rebuild Dev Containers Hot Reload in Containers Local Dev Best Practices

How Containers Get Networking and Storage Docker Networking Basics User-Defined Networks Volumes & Bind Mounts Storage Permissions Pitfalls Networking & Storage Best Practices

Tooling, Quality & Image Governance

Where Docker Fits in a Repository Repo Layout Basics Monorepo Build Contexts Base Image Internal Registry Project Setup Best Practices

What an Image Build Pipeline Is For Image CI Basics GitHub Actions & buildx Remote Cache Provenance & SLSA Build Pipeline Best Practices

Why Images Need Their Own Quality Gates Linting Basics dive & Image Efficiency Container Structure Tests Smoke Tests After Build Linting Best Practices

The Container Vulnerability Lifecycle Vulnerability Basics Base Image Pinning by Digest Exception Process Minimal Attack Surface Image Policy Best Practices

Why Rules Beat Tribal Knowledge Containers Rules Checklist Dockerfile Rules Kubernetes Manifest Rules ADR Template Containers Rules Best Practices

Platform Architecture & Design

What a Platform (IDP) Actually Is Platform Architecture Basics Golden Paths Multi-Cluster Topology Build vs Buy Managed K8s Platform Architecture Best Practices

How Multi-Tenancy Works in a Cluster Tenancy Basics Environment Separation Resource Quotas & LimitRanges Noisy Neighbor Controls Tenancy Best Practices

Separating Config and Secrets from Images Config Basics Secrets Management External Secrets Operator Config Reload Patterns Configuration Best Practices

How Kubernetes Thinks About Storage K8s Storage Basics CSI Drivers Stateful Data on Kubernetes Backup PVs Storage Architecture Best Practices

How Misconfiguration Becomes Outage Defect Scenarios Basics :latest in Production Probe Misconfiguration Resource Limit OOMKilled Defect Scenarios Best Practices

Kubernetes Core & Workloads

What Kubernetes Is and Why It Exists Kubernetes Basics Declarative vs Imperative kubectl Essentials API Objects & Reconciliation Labels & Selectors Kubernetes Fundamentals Best Practices

What a Pod Represents Pods Basics Why the Pod, Not the Container, Is the Unit Container Spec Liveness, Readiness & Startup Probes Requests & Limits Init & Sidecar Containers Pod Disruption Budgets Pods Best Practices

How Kubernetes Keeps N Copies Running Deployments Basics How Rolling Updates Actually Work Rolling Update Parameters Rollback Blue/Green & Canary Deployments Best Practices

Run-to-Completion vs Long-Running Work Jobs Basics CronJob Patterns Indexed & Parallel Jobs Jobs Best Practices

When Identity and Node Placement Matter StatefulSets Basics Headless Services + StatefulSets DaemonSets StatefulSets Best Practices

The Three Axes of Kubernetes Scaling Autoscaling Basics Horizontal Pod Autoscaler Cluster Autoscaler Vertical Pod Autoscaler KEDA Event-Driven Scaling Autoscaling Best Practices

A Map of the Kubernetes Machinery Kubernetes Internals Basics The Reconciliation Loop Explained Control Plane Internals etcd, Raft & Cluster State The Object Model: Spec, Status & resourceVersion Watches, Informers & the List-Watch Pattern Why Kubernetes Is a Distributed System Kubernetes Internals Best Practices

What Scheduling Is and Why It's Hard Scheduling Basics How the Scheduler Decides nodeSelector, Node Affinity & Anti-Affinity Taints & Tolerations Topology Spread Constraints Pod Priority, Preemption & the Descheduler Scheduling Best Practices

Extending Kubernetes: The Big Idea CRDs & Operators Basics The Operator Pattern Explained How Controllers Work (controller-runtime)CRD Design & Versioning Using Operators in Production Operators vs Helm vs Plain Manifests CRDs & Operators Best Practices

Kubernetes Networking & Mesh

Why Pods Need Services Services Basics Life of a Request ClusterIP & Headless NodePort & LoadBalancer EndpointSlices Services Best Practices

How External Traffic Reaches Your Pods Ingress Basics Ingress Controllers TLS Certificates Gateway API Ingress Best Practices

Why the Cluster Network Is Open by Default Network Policies Basics The Kubernetes Network Model Default-Deny Stance CNI Comparison DNS Egress Policies Network Policies Best Practices

How Services Find Each Other DNS Basics CoreDNS Configuration ExternalName & Split Horizon DNS Best Practices

What a Service Mesh Adds - and Costs Service Mesh Basics Linkerd Istio Mesh vs No-Mesh ADR Service Mesh Best Practices

Security, Policy & Observability

How Kubernetes Decides Who Can Do What RBAC Basics Service Accounts OIDC & SSO for kubectl RBAC Auditing RBAC Best Practices

The Layers of Pod Security Pod Security Basics Why Containers Aren’t a Security Boundary securityContext seccomp & AppArmor Pod Security Best Practices

Where Kubernetes Enforces Your Rules Admission Basics Kyverno Policies OPA Gatekeeper Policy Testing Admission Best Practices

The Three Pillars of Cluster Observability Observability Basics metrics-server & HPA Prometheus & Grafana Log Aggregation OpenTelemetry Collectors Observability Best Practices

Shift-Left vs Runtime Security Scanning Basics Runtime Security eBPF Observability Runtime Protection Best Practices

Delivery, GitOps & Operations

Templating vs Overlaying Manifests Helm Basics Chart Design Kustomize Helm vs Kustomize ADR Helm Best Practices

What GitOps Actually Means GitOps Basics Argo CD Flux Drift Detection GitOps Best Practices

From Commit to Running Pod Deploy Pipeline Basics Image Updater Bots Progressive Delivery CI/CD Best Practices

How a Living Cluster Gets Upgraded Upgrades Basics Node Image Updates Cordon & Drain Surge Node Pools Upgrade Best Practices

Why One Cluster Isn't Always Enough Multi-Cluster Basics Cluster API Fleet GitOps DR Cluster Standby Multi-Cluster Best Practices

Cloud Kubernetes & Ecosystem

What "Managed" Does and Doesn't Cover Managed K8s Basics Amazon EKS Google GKE Azure AKS Cloud Selection ADR Managed K8s Best Practices

The Platform Engineer's Toolkit, Conceptually Platform Tools Basics k9s & stern cert-manager external-dns Velero Platform Tools Best Practices

Why Kubernetes Costs What It Does Kubernetes Cost Basics Right-Sizing Requests & Limits Karpenter Spot & Interruptible Nodes Cost Visibility (OpenCost / Kubecost)Cost Optimization Best Practices

What a Packaged SME Skill Is Agent Skills Basics Dockerfile Review Skill Kubernetes Manifest Skill Incident Triage Skill Agent Skills Best Practices

Git as the Platform's Control Plane Git for Platform Work Basics Policy Bots in PRs Git Best Practices

Why Platform Work Drops to the Node Linux CLI Basics crictl & ctr nsenter & cgroup tools CLI Best Practices

Making App Devs Cluster-Safe Onboarding Basics Developer Self-Service Skills Matrix Pairing on Manifest PRs Team & Onboarding Best Practices

Tech-Lead Craft: Delivery, Leadership & Longevity

How to Think During a Cluster Incident Incident Basics CrashLoopBackOff Triage OOMKilled & CPU Throttling ImagePullBackOff & Registry Outages Node NotReady & CNI Failures Incident Response Best Practices

Treating the Platform as a Product Platform Delivery Basics Change Windows Platform SLOs Error Budgets for Platform Platform Delivery Best Practices

Leading a Platform, Not Just Running It Tech Lead Basics on Platforms Golden Path Governance Manifest Review Standards Build vs Buy Add-Ons Technical Leadership Best Practices

Translating Clusters into Business Language Stakeholder Basics Quota & Capacity Requests Risk Communication Stakeholder Best Practices

How to Read a Reference Architecture Reference: Multi-Tenant EKS Platform Reference: Worker-Heavy Cluster Reference: Regulated Environment Before/After: Compose → EKS Migration Before/After: Ingress → Gateway API Case Studies Best Practices

Why Governance Scales Where Heroics Don't Governance Basics Kubernetes Version Policy API Deprecation Tracking Extension & Add-On Governance Career Growth: Platform Engineer → Staff Governance Best Practices

/

/

© 2026 @csjcode|SystemsArchitect.io: Cloud Systems Tools|Terms

An independent, unofficial educational resource. Not affiliated with, endorsed, or sponsored by the brand/trademark maintainers/owners.

Search Documentation

Search across all documentation pages

Containers SME Cookbook

From Dockerfile layers and multi-stage builds through Pods, Deployments, Ingress, RBAC, Helm/Kustomize, Argo CD, cluster upgrades, and multi-cluster incident response - what every Docker/Kubernetes specialist should know.

Container Fundamentals

7 pages

What a Container Really Is, Container Basics, Containers vs Virtual Machines, OCI Image & Runtime Specs, Linux Namespaces & cgroups, ...

Docker Engine & CLI

7 pages

How the Docker Engine Works, Docker Engine Basics, Essential CLI Commands, Docker Contexts, Docker Desktop vs Linux Engine, Engine Configuration, ...

Dockerfiles & Builds

10 pages

How a Dockerfile Becomes an Image, Dockerfile Basics, How Image Layers & Union Filesystems Work, Multi-Stage Builds, BuildKit & Cache Mounts, ...

Registries & Supply Chain

7 pages

Why the Software Supply Chain Matters, Registries Basics, Tagging & Immutability, Registry Authentication, cosign & Image Signing, SBOM Generation, ...

6 pages

The Compose Model: Declaring a Local Stack, Compose Basics, Compose for Local Dev, Profiles & Overrides, Compose vs Kubernetes Gap, Compose Best Practices

Container Runtimes

6 pages

What Actually Runs Your Containers, Runtimes Basics, containerd & crictl, CRI-O, runc & Low-Level OCI, Runtimes Best Practices

Local Dev Workflows

6 pages

Dev/Prod Parity as a Mental Model, Local Dev Basics, Bind Mounts vs Image Rebuild, Dev Containers, Hot Reload in Containers, Local Dev Best Practices

Networking & Storage

6 pages

How Containers Get Networking and Storage, Docker Networking Basics, User-Defined Networks, Volumes & Bind Mounts, Storage Permissions Pitfalls, ...

5 pages

Where Docker Fits in a Repository, Repo Layout Basics, Monorepo Build Contexts, Base Image Internal Registry, Project Setup Best Practices

Build Pipelines & CI

6 pages

What an Image Build Pipeline Is For, Image CI Basics, GitHub Actions & buildx, Remote Cache, Provenance & SLSA, Build Pipeline Best Practices

Linting & Testing

6 pages

Why Images Need Their Own Quality Gates, Linting Basics, dive & Image Efficiency, Container Structure Tests, Smoke Tests After Build, Linting Best Practices

Image Policy & CVEs

6 pages

The Container Vulnerability Lifecycle, Vulnerability Basics, Base Image Pinning by Digest, Exception Process, Minimal Attack Surface, ...

Containers Rules

6 pages

Why Rules Beat Tribal Knowledge, Containers Rules Checklist, Dockerfile Rules, Kubernetes Manifest Rules, ADR Template, Containers Rules Best Practices

Platform Architecture

6 pages

What a Platform (IDP) Actually Is, Platform Architecture Basics, Golden Paths, Multi-Cluster Topology, Build vs Buy Managed K8s, ...

Workload & Tenancy

6 pages

How Multi-Tenancy Works in a Cluster, Tenancy Basics, Environment Separation, Resource Quotas & LimitRanges, Noisy Neighbor Controls, Tenancy Best Practices

Config & Secrets

6 pages

Separating Config and Secrets from Images, Config Basics, Secrets Management, External Secrets Operator, Config Reload Patterns, Configuration Best Practices

Storage Architecture

6 pages

How Kubernetes Thinks About Storage, K8s Storage Basics, CSI Drivers, Stateful Data on Kubernetes, Backup PVs, Storage Architecture Best Practices

Defect Scenarios

6 pages

How Misconfiguration Becomes Outage, Defect Scenarios Basics, :latest in Production, Probe Misconfiguration, Resource Limit OOMKilled, ...

Kubernetes Fundamentals

7 pages

What Kubernetes Is and Why It Exists, Kubernetes Basics, Declarative vs Imperative, kubectl Essentials, API Objects & Reconciliation, Labels & Selectors, ...

9 pages

What a Pod Represents, Pods Basics, Why the Pod, Not the Container, Is the Unit, Container Spec, Liveness, Readiness & Startup Probes, Requests & Limits, ...

7 pages

How Kubernetes Keeps N Copies Running, Deployments Basics, How Rolling Updates Actually Work, Rolling Update Parameters, Rollback, Blue/Green & Canary, ...

Jobs & CronJobs

5 pages

Run-to-Completion vs Long-Running Work, Jobs Basics, CronJob Patterns, Indexed & Parallel Jobs, Jobs Best Practices

StatefulSets & DaemonSets

5 pages

When Identity and Node Placement Matter, StatefulSets Basics, Headless Services + StatefulSets, DaemonSets, StatefulSets Best Practices

7 pages

The Three Axes of Kubernetes Scaling, Autoscaling Basics, Horizontal Pod Autoscaler, Cluster Autoscaler, Vertical Pod Autoscaler, KEDA Event-Driven Scaling, ...

9 pages

A Map of the Kubernetes Machinery, Kubernetes Internals Basics, The Reconciliation Loop Explained, Control Plane Internals, etcd, Raft & Cluster State, ...

8 pages

What Scheduling Is and Why It's Hard, Scheduling Basics, How the Scheduler Decides, nodeSelector, Node Affinity & Anti-Affinity, Taints & Tolerations, ...

CRDs & Operators

8 pages

Extending Kubernetes: The Big Idea, CRDs & Operators Basics, The Operator Pattern Explained, How Controllers Work (controller-runtime), CRD Design & Versioning, ...

Services & kube-proxy

7 pages

Why Pods Need Services, Services Basics, Life of a Request, ClusterIP & Headless, NodePort & LoadBalancer, EndpointSlices, Services Best Practices

Ingress & Gateway API

6 pages

How External Traffic Reaches Your Pods, Ingress Basics, Ingress Controllers, TLS Certificates, Gateway API, Ingress Best Practices

Network Policies & CNI

7 pages

Why the Cluster Network Is Open by Default, Network Policies Basics, The Kubernetes Network Model, Default-Deny Stance, CNI Comparison, DNS Egress Policies, ...

DNS & Discovery

5 pages

How Services Find Each Other, DNS Basics, CoreDNS Configuration, ExternalName & Split Horizon, DNS Best Practices

6 pages

What a Service Mesh Adds - and Costs, Service Mesh Basics, Linkerd, Istio, Mesh vs No-Mesh ADR, Service Mesh Best Practices

6 pages

How Kubernetes Decides Who Can Do What, RBAC Basics, Service Accounts, OIDC & SSO for kubectl, RBAC Auditing, RBAC Best Practices

6 pages

The Layers of Pod Security, Pod Security Basics, Why Containers Aren’t a Security Boundary, securityContext, seccomp & AppArmor, Pod Security Best Practices

Admission & Policy

6 pages

Where Kubernetes Enforces Your Rules, Admission Basics, Kyverno Policies, OPA Gatekeeper, Policy Testing, Admission Best Practices

7 pages

The Three Pillars of Cluster Observability, Observability Basics, metrics-server & HPA, Prometheus & Grafana, Log Aggregation, OpenTelemetry Collectors, ...

Scanning & Runtime

5 pages

Shift-Left vs Runtime Security, Scanning Basics, Runtime Security, eBPF Observability, Runtime Protection Best Practices

Helm & Kustomize

6 pages

Templating vs Overlaying Manifests, Helm Basics, Chart Design, Kustomize, Helm vs Kustomize ADR, Helm Best Practices

6 pages

What GitOps Actually Means, GitOps Basics, Argo CD, Flux, Drift Detection, GitOps Best Practices

5 pages

From Commit to Running Pod, Deploy Pipeline Basics, Image Updater Bots, Progressive Delivery, CI/CD Best Practices

Upgrades & Nodes

6 pages

How a Living Cluster Gets Upgraded, Upgrades Basics, Node Image Updates, Cordon & Drain, Surge Node Pools, Upgrade Best Practices

Multi-Cluster & Fleet

6 pages

Why One Cluster Isn't Always Enough, Multi-Cluster Basics, Cluster API, Fleet GitOps, DR Cluster Standby, Multi-Cluster Best Practices

7 pages

What "Managed" Does and Doesn't Cover, Managed K8s Basics, Amazon EKS, Google GKE, Azure AKS, Cloud Selection ADR, Managed K8s Best Practices

7 pages

The Platform Engineer's Toolkit, Conceptually, Platform Tools Basics, k9s & stern, cert-manager, external-dns, Velero, Platform Tools Best Practices

7 pages

Why Kubernetes Costs What It Does, Kubernetes Cost Basics, Right-Sizing Requests & Limits, Karpenter, Spot & Interruptible Nodes, ...

6 pages

What a Packaged SME Skill Is, Agent Skills Basics, Dockerfile Review Skill, Kubernetes Manifest Skill, Incident Triage Skill, Agent Skills Best Practices

4 pages

Git as the Platform's Control Plane, Git for Platform Work Basics, Policy Bots in PRs, Git Best Practices

5 pages

Why Platform Work Drops to the Node, Linux CLI Basics, crictl & ctr, nsenter & cgroup tools, CLI Best Practices

Team & Onboarding

6 pages

Making App Devs Cluster-Safe, Onboarding Basics, Developer Self-Service, Skills Matrix, Pairing on Manifest PRs, Team & Onboarding Best Practices

Incident Response

7 pages

How to Think During a Cluster Incident, Incident Basics, CrashLoopBackOff Triage, OOMKilled & CPU Throttling, ImagePullBackOff & Registry Outages, ...

Delivery & SLOs

6 pages

Treating the Platform as a Product, Platform Delivery Basics, Change Windows, Platform SLOs, Error Budgets for Platform, Platform Delivery Best Practices

Tech Leadership

6 pages

Leading a Platform, Not Just Running It, Tech Lead Basics on Platforms, Golden Path Governance, Manifest Review Standards, Build vs Buy Add-Ons, ...

Product & Stakeholders

5 pages

Translating Clusters into Business Language, Stakeholder Basics, Quota & Capacity Requests, Risk Communication, Stakeholder Best Practices

7 pages

How to Read a Reference Architecture, Reference: Multi-Tenant EKS Platform, Reference: Worker-Heavy Cluster, Reference: Regulated Environment, ...

Standards & Governance

7 pages

Why Governance Scales Where Heroics Don't, Governance Basics, Kubernetes Version Policy, API Deprecation Tracking, Extension & Add-On Governance, ...