https://anekoique.github.io/tags/containers/ Recent content in Containers on Anekoique's Blog Hugo -- 0.148.2 en Sat, 27 Jun 2026 13:00:00 +0800 https://anekoique.github.io/virtualization/systems/kata/ Sat, 27 Jun 2026 13:00:00 +0800 https://anekoique.github.io/virtualization/systems/kata/ The container-VM hybrid: an OCI runtime placing each container or Kubernetes pod inside a microVM (QEMU / Firecracker / cloud-hypervisor / Dragonball) running a real Linux kernel. Hardware-grade isolation with container UX; substrate for Confidential Containers. https://anekoique.github.io/virtualization/systems/docker/ Sat, 27 Jun 2026 12:00:00 +0800 https://anekoique.github.io/virtualization/systems/docker/ The canonical OS-level virtualization stack: containers as host processes restricted by namespaces, cgroups, seccomp, capabilities, OverlayFS, and netfilter. Full walk from Docker Engine to containerd to runc to kernel features. https://anekoique.github.io/virtualization/systems/gvisor/ Sat, 27 Jun 2026 11:00:00 +0800 https://anekoique.github.io/virtualization/systems/gvisor/ Google’s userspace-kernel sandbox: Sentry, a Go reimplementation of the Linux syscall ABI, services guest syscalls intercepted via KVM / ptrace / systrap platforms. Production isolation behind App Engine, Cloud Run, and Cloud Functions.