Docker & Kubernetes Architecture Concepts
20 in-depth architectural topics from Linux kernel namespaces and cgroups to OverlayFS, Pod scheduling, and kube-proxy.
Linux Kernel Namespaces: The Illusion of a Private Machine
A container is just a standard Linux process isolated by 6 Kernel Namespaces: PID (Process IDs), NET (Network stacks/IPs), MNT (Mount points/RootFS), IPC (Inter-Process Comm), UTS (Hostname), and USER (UID/GID mapping).
Control Groups (cgroups v2): CPU Quotas & The OOM Killer
While Namespaces control WHAT a container can see, Control Groups (cgroups) control HOW MUCH host resources (CPU cycles, Memory, Disk I/O, PIDs) a container is permitted to consume.
OverlayFS & Layered Image Architecture (lowerdir vs upperdir)
Docker images are composed of read-only immutable layers (lowerdir) combined with a thin read-write container layer (upperdir). OverlayFS presents a unified merged filesystem view via Copy-on-Write (CoW).
Docker Networking: Bridge Networks, veth Pairs & iptables NAT
Docker connects containers using Virtual Ethernet (veth) cable pairs linked to a Linux software bridge (docker0 / custom bridge), routing incoming traffic via iptables PREROUTING NAT tables.
Kubernetes Control Plane: Declarative Reconciliation Loop
The Kubernetes Control Plane maintains desired cluster state through continuous reconciliation: kube-apiserver (REST hub) <-> etcd (Raft state store) <-> kube-scheduler (Node placement) <-> kube-controller-manager (Reconciliation loops).
Kubernetes Pod Lifecycle & Health Probes (Liveness vs Readiness)
A Pod is the smallest deployable compute unit in Kubernetes (sharing network IP and storage volumes). Health probes determine if containers should be restarted (Liveness), receive traffic (Readiness), or given time to boot (Startup).
Kubernetes Services & kube-proxy Packet Routing (iptables vs IPVS)
Since Pod IPs are ephemeral and change upon restart, a Service provides a stable virtual ClusterIP and DNS name, load-balancing traffic across matching Pod endpoints via kube-proxy iptables/IPVS rules.
Ingress Controllers & Layer-7 HTTP Routing
Ingress acts as a smart HTTP/HTTPS reverse proxy and API Gateway at the edge of the cluster, providing path-based routing (/api -> api-svc, / -> web-svc) and TLS termination with a single public Load Balancer.