Containers & Kubernetes
Containers, Linux namespaces, cgroups, Kubernetes basics, and the pod process model.
5 questions
JuniorTheoryCommonWhat is a container and how does it differ from a virtual machine?
What is a container and how does it differ from a virtual machine?
A container is OS-level virtualization — a process that shares the host kernel but gets an isolated view via Linux namespaces and bounded resources via cgroups. A virtual machine runs a full guest OS on virtualized hardware, so it is far heavier.
Common mistakes
- ✗Believing a container runs its own kernel — it shares the host kernel
- ✗Thinking a container is only a packaging format with no runtime isolation
- ✗Assuming container and VM startup costs and overhead are roughly equal
Follow-up questions
- →Which Linux kernel features make container isolation possible?
- →Why can a container only run binaries built for the host kernel's OS?
JuniorTheoryCommonWhat does Kubernetes do, and what are pods and deployments?
What does Kubernetes do, and what are pods and deployments?
Kubernetes is a container orchestrator — it schedules containers onto nodes and keeps them running. A pod is the smallest deployable unit: one or more containers sharing a network namespace, with cgroup resource limits. A Deployment manages a replica set and rolling updates.
Common mistakes
- ✗Thinking a pod is always exactly one container — it can hold several sharing a network namespace
- ✗Confusing a Deployment with a pod — the Deployment manages replicas and rolling updates
- ✗Believing Kubernetes builds container images rather than scheduling and running them
Follow-up questions
- →What does a Service add on top of a Deployment?
- →How does a Deployment perform a rolling update without downtime?
MiddleTheoryCommonWhat do cgroups control, and how do they bound a container's resources?
What do cgroups control, and how do they bound a container's resources?
A cgroup limits and accounts for a process group's CPU, memory, and I/O. A CPU limit throttles the group's scheduler share; a memory limit caps resident memory — breaching it triggers the OOM killer inside that cgroup. Containers map each resource limit to a cgroup setting.
Common mistakes
- ✗Confusing cgroups with namespaces — cgroups limit resources, namespaces isolate visibility
- ✗Thinking a memory limit breach is logged rather than triggering the OOM killer
- ✗Believing a CPU limit pins cores instead of throttling the scheduler share
Follow-up questions
- →How does a CPU cgroup throttle a process without removing cores from it?
- →Why can a process be OOM-killed while the host still has free memory?
MiddleTheoryCommonHow do Linux namespaces provide process isolation for a container?
How do Linux namespaces provide process isolation for a container?
Each namespace isolates one class of kernel resource and gives the process group its own view of it. PID hides other processes, net gives a private network stack, mnt a private filesystem tree, UTS its own hostname, plus IPC and user. A container has a fresh set of these.
Common mistakes
- ✗Confusing namespaces with cgroups — namespaces isolate visibility, cgroups limit resources
- ✗Thinking one namespace covers all resources rather than one class each
- ✗Believing namespace isolation is enforced in userspace instead of by the kernel
Follow-up questions
- →What does the user namespace let an unprivileged process do?
- →How can two containers be made to share one network namespace?
SeniorTheoryOccasionalWhat does a process look like inside a Kubernetes pod, seen with ps or top?
What does a process look like inside a Kubernetes pod, seen with ps or top?
The container's main process is PID 1 in its own PID namespace. As PID 1 it must reap zombie children and receive signals — a naive binary often does neither. ps and top inside the container see only that pod's processes; the host sees the same processes under different PIDs.
Common mistakes
- ✗Forgetting the container's main process is PID 1 and must reap zombies and handle signals
- ✗Thinking
psinside a container lists host processes — the PID namespace hides them - ✗Assuming a process keeps the same PID inside the container and on the host
Follow-up questions
- →Why does PID 1 not getting SIGTERM handling cause slow pod shutdowns?
- →What problem does a minimal init like
tinisolve as PID 1?
