Complete Containers & Kubernetes Architecture Visualizer

Master the Docker & K8s Engine.

Interactive visualizers for the 6 Linux Kernel Namespaces, OverlayFS Copy-on-Write layers, multi-stage build caching, cgroups v2 resource limits, Kubernetes Pod lifecycle, Ingress controllers, and cross-node CNI eBPF packet routing.

Explore 20 Concepts CLI Sandbox

Linux Kernel Isolation Engine

Linux Namespaces Inspector: The 6 Pillars of Container Isolation

Syscall: CLONE_NEWPID

Host OS Perspective (Global)Linux Kernel

Host sees PID 48291 (node server.js) alongside 300 other host processes.

Container Perspective (Isolated)Private Illusion

Container sees PID 1 (node server.js) as the root init process. Host processes are 100% invisible!

Kernel Architectural Role:

Provides private process hierarchy. Signals (SIGKILL, SIGTERM) cannot be sent to host processes from inside the container.

Storage Driver Architecture

OverlayFS Union Filesystem & Copy-on-Write (CoW)

lowerdir + upperdir = merged

Container Read-Write Layer (upperdir)Ephemeral (Deleted with container)

Empty (No files written yet)

Image Layer #3 (lowerdir) [sha256:4f8e...]Read-Only Immutable

COPY . /app ➔ /app/app.js (Original code)

Image Layer #2 (lowerdir) [sha256:91bc...]Read-Only Immutable

RUN apk add nodejs ➔ /usr/bin/node (Node runtime binaries)

Base Image Layer #1 (lowerdir) [sha256:3a11...]Read-Only Immutable

FROM alpine:latest ➔ /bin/sh, /etc/os-release, /lib/ld-musl.so

Storage Engine Log:

OverlayFS mounted. All 3 image layers in lowerdir are read-only and immutable.

BuildKit & Image Optimization

Multi-Stage Dockerfile & Layer Cache Optimizer

Final Image Size: 48 MB (Distroless)

1. Select Build Architecture:

2. Trigger Source Code Edit:

BuildKit Layer Execution Trace:⚡ 90% Cache Reused (1.2s Build)

[1/4] FROM node:22-alpine AS builderCACHED

[2/4] COPY package*.json ./ && RUN npm ciCACHED

[3/4] COPY src/ ./src && RUN npm run buildCACHE BUSTED ⚙️ RECOMPILED

[4/4] FROM gcr.io/distroless/nodejs22-debian12 && COPY --from=builder /app/distMINIMAL PRODUCTION RUNTIME (48MB)

Linux Resource Enforcement

Control Groups (cgroups v2) & The OOM Killer

CONTAINER RUNNING

memory.max (Hard Limit)256 MB / 512 MB

Safe headroom available

cpu.max (CFS Quota: 0.5 CPU)100% RESPONSIVE

Linux Completely Fair Scheduler limits execution time to 50,000µs per 100,000µs period.

cgroups Engine Log:

Container running smoothly within cgroups v2 limits (memory.max: 512MB, cpu.max: 0.5 CPU).

Kubernetes Orchestration Engine

Pod Lifecycle Stepper & CrashLoopBackOff Analyzer

STATUS: Pending

Lifecycle Stage Analysis:

1. Pending & Scheduling

kube-scheduler binds Pod to Node

The Pod is accepted by kube-apiserver. kube-scheduler inspects CPU/Memory requests and assigns the Pod to worker-node-02.

Cluster Networking Architecture

Kubernetes Service & kube-proxy Packet Routing

Type: ClusterIP

Packet Route: Client ➔ ClusterIP ➔ kube-proxy ➔ Target PodRouted to: Pod #1 (10.244.1.11)

Pod #1 (api-app)

IP: 10.244.1.11:8080

⚡ RECEIVING REQUEST

Pod #2 (api-app)

IP: 10.244.1.12:8080

💤 READY

Pod #3 (api-app)

IP: 10.244.1.13:8080

💤 READY

Layer-7 Edge Routing Engine

Kubernetes Ingress Controller & TLS Gateway

TLS Terminated (cert-manager)

Incoming HTTP Request: https://api.example.com/v1/usersPublic Cloud LB: 34.120.45.10

1. Ingress Controller (Nginx / Envoy)

Matches Host: api.example.com
Matches Path: /v1/users

2. ClusterIP Service

user-service (10.96.0.12)
Virtual internal IP routing

3. Live Pod Endpoints

• user-pod-89a (10.244.1.4)

• user-pod-92b (10.244.2.7)

Container Network Interface (CNI)

Cross-Node Pod Networking: Flannel vs Calico vs Cilium eBPF

⚡ eBPF Socket Bypass (Wire Speed)

Cross-Node Journey: Pod A (10.244.1.5) ➔ Pod B (10.244.2.8)cilium-ebpf

Worker Node 1 (192.168.1.10)

• Source: Pod A (IP: 10.244.1.5)

• Packet egresses container via veth0 pair

• eBPF program hooks socket buffer directly in kernel space!

Worker Node 2 (192.168.1.11)

• Physical adapter eth0 receives packet

• eBPF delivers packet directly to Pod socket buffer (0 iptables rules!)

• Delivered to: Pod B (10.244.2.8) ✅

Interactive Cloud Native Sandbox

Docker & Kubernetes CLI Terminal Simulator

docker CLI & kubectl v1.31

Presets:

Terminal OutputExit Code: 0

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

7f9a82b4c12d nginx:alpine "/docker-entrypoint.…" 2 minutes ago Up 2 minutes 0.0.0.0:8080->80/tcp web-server

1e4d9c8b7a0f redis:7-alpine "docker-entrypoint.s…" 10 mins ago Up 10 mins 6379/tcp cache-db