React
React Native
Node.js
Python
Rust
PostgreSQL
Solana
Claude
AI Agents
Go
Containers

Containers SME Cookbook

Sections

Container Fundamentals & Docker Core

What a Container Really Is Container Basics Containers vs Virtual Machines OCI Image & Runtime Specs Linux Namespaces & cgroups Immutable Infrastructure Principle Container Fundamentals Best Practices

How the Docker Engine Works Docker Engine Basics Essential CLI Commands Docker Contexts Docker Desktop vs Linux Engine Engine Configuration Docker Engine Best Practices

How a Dockerfile Becomes an Image Dockerfile Basics How Image Layers & Union Filesystems Work Multi-Stage Builds BuildKit & Cache Mounts buildx & Multi-Arch Images `.dockerignore` & Build Context Non-Root Users in Images Distroless & Minimal Bases Dockerfiles Best Practices

Why the Software Supply Chain Matters Registries Basics Tagging & Immutability Registry Authentication cosign & Image Signing SBOM Generation Supply Chain Best Practices

The Compose Model: Declaring a Local Stack Compose Basics Compose for Local Dev Profiles & Overrides Compose vs Kubernetes Gap Compose Best Practices

What Actually Runs Your Containers Runtimes Basics containerd & crictl CRI-O runc & Low-Level OCI Runtimes Best Practices

Dev/Prod Parity as a Mental Model Local Dev Basics Bind Mounts vs Image Rebuild Dev Containers Hot Reload in Containers Local Dev Best Practices

How Containers Get Networking and Storage Docker Networking Basics User-Defined Networks Volumes & Bind Mounts Storage Permissions Pitfalls Networking & Storage Best Practices

Tooling, Quality & Image Governance

Where Docker Fits in a Repository Repo Layout Basics Monorepo Build Contexts Base Image Internal Registry Project Setup Best Practices

What an Image Build Pipeline Is For Image CI Basics GitHub Actions & buildx Remote Cache Provenance & SLSA Build Pipeline Best Practices

Why Images Need Their Own Quality Gates Linting Basics dive & Image Efficiency Container Structure Tests Smoke Tests After Build Linting Best Practices

The Container Vulnerability Lifecycle Vulnerability Basics Base Image Pinning by Digest Exception Process Minimal Attack Surface Image Policy Best Practices

Why Rules Beat Tribal Knowledge Containers Rules Checklist Dockerfile Rules Kubernetes Manifest Rules ADR Template Containers Rules Best Practices

Platform Architecture & Design

What a Platform (IDP) Actually Is Platform Architecture Basics Golden Paths Multi-Cluster Topology Build vs Buy Managed K8s Platform Architecture Best Practices

How Multi-Tenancy Works in a Cluster Tenancy Basics Environment Separation Resource Quotas & LimitRanges Noisy Neighbor Controls Tenancy Best Practices

Separating Config and Secrets from Images Config Basics Secrets Management External Secrets Operator Config Reload Patterns Configuration Best Practices

How Kubernetes Thinks About Storage K8s Storage Basics CSI Drivers Stateful Data on Kubernetes Backup PVs Storage Architecture Best Practices

How Misconfiguration Becomes Outage Defect Scenarios Basics :latest in Production Probe Misconfiguration Resource Limit OOMKilled Defect Scenarios Best Practices

Kubernetes Core & Workloads

What Kubernetes Is and Why It Exists Kubernetes Basics Declarative vs Imperative kubectl Essentials API Objects & Reconciliation Labels & Selectors Kubernetes Fundamentals Best Practices

What a Pod Represents Pods Basics Why the Pod, Not the Container, Is the Unit Container Spec Liveness, Readiness & Startup Probes Requests & Limits Init & Sidecar Containers Pod Disruption Budgets Pods Best Practices

How Kubernetes Keeps N Copies Running Deployments Basics How Rolling Updates Actually Work Rolling Update Parameters Rollback Blue/Green & Canary Deployments Best Practices

Run-to-Completion vs Long-Running Work Jobs Basics CronJob Patterns Indexed & Parallel Jobs Jobs Best Practices

When Identity and Node Placement Matter StatefulSets Basics Headless Services + StatefulSets DaemonSets StatefulSets Best Practices

The Three Axes of Kubernetes Scaling Autoscaling Basics Horizontal Pod Autoscaler Cluster Autoscaler Vertical Pod Autoscaler KEDA Event-Driven Scaling Autoscaling Best Practices

A Map of the Kubernetes Machinery Kubernetes Internals Basics The Reconciliation Loop Explained Control Plane Internals etcd, Raft & Cluster State The Object Model: Spec, Status & resourceVersion Watches, Informers & the List-Watch Pattern Why Kubernetes Is a Distributed System Kubernetes Internals Best Practices

What Scheduling Is and Why It's Hard Scheduling Basics How the Scheduler Decides nodeSelector, Node Affinity & Anti-Affinity Taints & Tolerations Topology Spread Constraints Pod Priority, Preemption & the Descheduler Scheduling Best Practices

Extending Kubernetes: The Big Idea CRDs & Operators Basics The Operator Pattern Explained How Controllers Work (controller-runtime)CRD Design & Versioning Using Operators in Production Operators vs Helm vs Plain Manifests CRDs & Operators Best Practices

Kubernetes Networking & Mesh

Why Pods Need Services Services Basics Life of a Request ClusterIP & Headless NodePort & LoadBalancer EndpointSlices Services Best Practices

How External Traffic Reaches Your Pods Ingress Basics Ingress Controllers TLS Certificates Gateway API Ingress Best Practices

Why the Cluster Network Is Open by Default Network Policies Basics The Kubernetes Network Model Default-Deny Stance CNI Comparison DNS Egress Policies Network Policies Best Practices

How Services Find Each Other DNS Basics CoreDNS Configuration ExternalName & Split Horizon DNS Best Practices

What a Service Mesh Adds - and Costs Service Mesh Basics Linkerd Istio Mesh vs No-Mesh ADR Service Mesh Best Practices

Security, Policy & Observability

How Kubernetes Decides Who Can Do What RBAC Basics Service Accounts OIDC & SSO for kubectl RBAC Auditing RBAC Best Practices

The Layers of Pod Security Pod Security Basics Why Containers Aren’t a Security Boundary securityContext seccomp & AppArmor Pod Security Best Practices

Where Kubernetes Enforces Your Rules Admission Basics Kyverno Policies OPA Gatekeeper Policy Testing Admission Best Practices

The Three Pillars of Cluster Observability Observability Basics metrics-server & HPA Prometheus & Grafana Log Aggregation OpenTelemetry Collectors Observability Best Practices

Shift-Left vs Runtime Security Scanning Basics Runtime Security eBPF Observability Runtime Protection Best Practices

Delivery, GitOps & Operations

Templating vs Overlaying Manifests Helm Basics Chart Design Kustomize Helm vs Kustomize ADR Helm Best Practices

What GitOps Actually Means GitOps Basics Argo CD Flux Drift Detection GitOps Best Practices

From Commit to Running Pod Deploy Pipeline Basics Image Updater Bots Progressive Delivery CI/CD Best Practices

How a Living Cluster Gets Upgraded Upgrades Basics Node Image Updates Cordon & Drain Surge Node Pools Upgrade Best Practices

Why One Cluster Isn't Always Enough Multi-Cluster Basics Cluster API Fleet GitOps DR Cluster Standby Multi-Cluster Best Practices

Cloud Kubernetes & Ecosystem

What "Managed" Does and Doesn't Cover Managed K8s Basics Amazon EKS Google GKE Azure AKS Cloud Selection ADR Managed K8s Best Practices

The Platform Engineer's Toolkit, Conceptually Platform Tools Basics k9s & stern cert-manager external-dns Velero Platform Tools Best Practices

Why Kubernetes Costs What It Does Kubernetes Cost Basics Right-Sizing Requests & Limits Karpenter Spot & Interruptible Nodes Cost Visibility (OpenCost / Kubecost)Cost Optimization Best Practices

What a Packaged SME Skill Is Agent Skills Basics Dockerfile Review Skill Kubernetes Manifest Skill Incident Triage Skill Agent Skills Best Practices

Git as the Platform's Control Plane Git for Platform Work Basics Policy Bots in PRs Git Best Practices

Why Platform Work Drops to the Node Linux CLI Basics crictl & ctr nsenter & cgroup tools CLI Best Practices

Making App Devs Cluster-Safe Onboarding Basics Developer Self-Service Skills Matrix Pairing on Manifest PRs Team & Onboarding Best Practices

Tech-Lead Craft: Delivery, Leadership & Longevity

How to Think During a Cluster Incident Incident Basics CrashLoopBackOff Triage OOMKilled & CPU Throttling ImagePullBackOff & Registry Outages Node NotReady & CNI Failures Incident Response Best Practices

Treating the Platform as a Product Platform Delivery Basics Change Windows Platform SLOs Error Budgets for Platform Platform Delivery Best Practices

Leading a Platform, Not Just Running It Tech Lead Basics on Platforms Golden Path Governance Manifest Review Standards Build vs Buy Add-Ons Technical Leadership Best Practices

Translating Clusters into Business Language Stakeholder Basics Quota & Capacity Requests Risk Communication Stakeholder Best Practices

How to Read a Reference Architecture Reference: Multi-Tenant EKS Platform Reference: Worker-Heavy Cluster Reference: Regulated Environment Before/After: Compose → EKS Migration Before/After: Ingress → Gateway API Case Studies Best Practices

Why Governance Scales Where Heroics Don't Governance Basics Kubernetes Version Policy API Deprecation Tracking Extension & Add-On Governance Career Growth: Platform Engineer → Staff Governance Best Practices

/

/

© 2026 @csjcode|SystemsArchitect.io: Cloud Systems Tools|Terms

An independent, unofficial educational resource. Not affiliated with, endorsed, or sponsored by the brand/trademark maintainers/owners.

Search Documentation

Search across all documentation pages

Containers SME/Scanning & Runtime

Scanning & Runtime

5 pages in this section.

1

Shift-Left vs Runtime Security

Why pre-deploy scanning and runtime detection are complementary defenses, not redundant ones

Kubernetes Security Security Scanning Runtime Explainer

2

Scanning Basics

CI scan + admission deny on critical CVEs

Kubernetes Security Security Scanning Runtime Basics

3

Runtime Security

Kubernetes Security Security Scanning Runtime Guide

4

eBPF Observability

Kubernetes Security Security Scanning Runtime Guide

5

Runtime Protection Best Practices

Detect drift; don’t rely only on pre-deploy scans

Kubernetes Security Security Scanning Runtime Best Practices