At 2:40 one morning a Skylane service started failing health checks on every node at once. The code hadn’t changed. The cause was a base library on the build server that had been quietly upgraded, so the binary we shipped no longer matched the one we tested. Containers exist to end that kind of night: you ship the program and everything it needs as one artifact, and the artifact you tested is the artifact that runs.
\nI’m Amara Diallo. I run on-call for Skylane’s clusters, and everything in this course is something I’ve either broken or watched break. We’ll work on one service the whole way through.
\nnotes-api is a small HTTP API for notes, written in TypeScript and running on Node.js 24. It stores data in Postgres and exposes four routes: GET /notes, POST /notes, GET /healthz (is the process alive?) and GET /readyz (can it reach the database?). It listens on port 3000 and reads its settings from environment variables such as DATABASE_URL.
By the end you’ll have built its image, run it with Postgres on your laptop, and deployed it to Kubernetes with health checks, autoscaling and a rollback plan.
\nThere is no “container” object inside the Linux kernel. When you run a container, the runtime starts an ordinary process and wraps it with three things:
\nnode_modules, a few system libraries.Because there’s no guest OS to boot, a container starts as fast as the program inside it. The trade-off is that every container on a host shares one kernel. A VM is a stronger wall; a container is a well-locked door. That’s why later lessons insist on non-root users and small images: you shrink what an attacker can do if they get through the door.
\nOn macOS and Windows, Docker Desktop runs one lightweight Linux VM and puts your containers inside it. The model is the same; there’s one extra layer underneath.
\nAn image is a read-only, layered snapshot of a filesystem plus metadata: which command to run, which port the app expects, which user to run as. A container is a running instance of an image with a thin writable layer on top.
\nThe class-and-object comparison holds up well: one image, many containers. When we scale notes-api to six replicas in Kubernetes, that’s one image and six containers. Each container’s writable layer is private and disposable, so the rule from day one is: containers are cattle, data lives elsewhere. Postgres will keep its files in a volume, never in a container’s writable layer.
\n\nNext you’ll write notes-api’s first Dockerfile and turn source code into an image you can run.
\n","toc":[{"id":"sec-1","text":"The project: notes-api","level":2},{"id":"sec-2","text":"A container is a process","level":2},{"id":"sec-3","text":"Image versus container","level":2}],"takeaways":["A container is a normal Linux process that the kernel isolates with namespaces and limits with cgroups.","Containers share the host kernel, which is why they start in milliseconds and why they are a weaker boundary than a virtual machine.","An image is a read-only template of filesystem layers plus metadata; a container is one running instance of it with a thin writable layer on top.","Anything a container writes to its own filesystem disappears when the container is removed unless you put it in a volume."],"further":[{"title":"What is a container?","url":"https://docs.docker.com/get-started/docker-concepts/the-basics/what-is-a-container/"},{"title":"What is an image?","url":"https://docs.docker.com/get-started/docker-concepts/the-basics/what-is-an-image/"},{"title":"Kubernetes Overview","url":"https://kubernetes.io/docs/concepts/overview/"}],"quiz":[{"q":"You run ps aux on a Linux host while a container is running a Node.js server. What do you see?
dockerd process; the Node.js server is hidden inside it.","why":"The daemon starts containers but doesn’t host them. The container’s process is its own entry in the host’s process table."},{"text":"The node process, listed like any other process on the host.","why":"Correct. A container is a host process. Namespaces hide the rest of the host from it, not the other way round."},{"text":"A copy of the container’s whole operating system booting in the background.","why":"Containers don’t boot an OS. They reuse the host kernel and start only the command you asked for."}],"answer":2},{"q":"Which kernel feature stops a runaway container from using all of the host’s memory?
","options":[{"text":"Control groups (cgroups), which cap and account for CPU, memory and I/O.","why":"Correct. cgroups enforce resource limits; later in the course Kubernetes limits compile down to exactly these settings."},{"text":"The PID namespace, which gives the container its own process tree.","why":"Namespaces control what a process can see, not how much it can use. A process in its own PID namespace can still eat every byte of RAM."},{"text":"The image’s read-only layers, which can’t grow at runtime.","why":"Read-only layers limit what’s on disk, not memory use. A process can allocate RAM regardless of how its files are stored."},{"text":"The container’s writable layer, which is sized to the memory limit.","why":"The writable layer is disk storage for file changes. It has nothing to do with RAM."}],"answer":0},{"q":"You start three containers from the image notes-api:1.0.0. One of them writes a file to /tmp/cache.json. What do the other two see?
Why is a container a weaker security boundary than a virtual machine?
","options":[{"text":"Containers can’t restrict network access at all.","why":"Network namespaces give each container its own network stack, and you can restrict it further. Networking is not the gap."},{"text":"All containers on a host share one kernel, so a kernel exploit can cross between them.","why":"Correct. A VM has its own kernel behind a hypervisor; a container talks straight to the host kernel. That’s the price of millisecond start-up."},{"text":"Container images can’t be signed or verified.","why":"Images can be signed and pinned by digest; that is image supply-chain security, not an isolation boundary."},{"text":"Containers always run as root on the host.","why":"Many do by default, which is bad, but you can and should run them as a non-root user. The shared kernel is the structural difference."}],"answer":1}],"exercise":{"kind":"choice","multiple":true,"options":["shared-kernel","own-writable","vm-each","cgroups-see","image-many"],"correct":["shared-kernel","own-writable","image-many"],"title":"True or false: what a container is","prompt":"A teammate is writing an onboarding doc for notes-api and asks you to review five claims about containers. Select every statement that is correct.
\n","hints":["Ask of each claim: is this about what a process can see, what it can use, or what’s on its disk?","Namespaces are about visibility; cgroups are about resource limits.","Three of the five are correct."],"explanation":"Containers are host processes that share the host kernel, which is why they start fast and why isolation is weaker than a VM. Each container gets its own writable layer on top of the shared read-only image, and one image can back any number of containers. Docker on Linux does not create a VM per container, and cgroups limit resource use; it’s namespaces that control what a process can see.
\n","checkLabels":{},"optionText":{"shared-kernel":{"text":"Every container on a Linux host uses the same kernel as the host.","why":"Correct. There is no guest kernel. That is the source of both the speed and the weaker isolation."},"own-writable":{"text":"Each container gets its own writable layer; changes there vanish when the container is removed.","why":"Correct. That’s why data that must survive goes in a volume."},"vm-each":{"text":"Docker creates a small virtual machine for each container so they can’t affect each other.","why":"Not on Linux. Docker Desktop uses one shared VM on macOS and Windows, but containers inside it are still processes on one kernel."},"cgroups-see":{"text":"cgroups decide which files and processes a container is allowed to see.","why":"That’s namespaces. cgroups cap and account for CPU, memory and I/O."},"image-many":{"text":"One image can be the template for many running containers at once.","why":"Correct. Scaling to six replicas means six containers from one image."}}},"words":559,"readMinutes":3}