📦 Containers

The Shipping Container Analogy

Before standardized shipping containers:

• Goods loaded individually onto ships
• Different shapes, sizes, handling requirements
• "Will it fit? Will it break?"

After standardized shipping containers:

• Standard sizes fit any ship, truck, train
• Contents don't matter - container is the unit
• Predictable, stackable, transportable

Software containers work the same way. Package your application with everything it needs. It runs the same everywhere.

What Problem Do Containers Solve?

"Works on My Machine"

Why?

• Different OS version
• Different library versions
• Different configuration
• Missing dependencies

Containers Fix This

Container includes:

If it works in the container locally, it works in the container on the server.

Containers vs Virtual Machines

Architecture Comparison

Virtual Machines:                   Containers:
┌───────────────────┐               ┌─────┐ ┌─────┐ ┌─────┐
│     Your App      │               │App A│ │App B│ │App C│
├───────────────────┤               └──┬──┘ └──┬──┘ └──┬──┘
│   Guest OS (large)│                  └───────┼───────┘
├───────────────────┤                 Container Runtime
│    Hypervisor     │                          │
├───────────────────┤                       Host OS
│      Host OS      │                          │
└───────────────────┘                       Hardware

Each VM = Full OS copy             Containers share host kernel

Side-by-Side

Container Building Blocks

Images

An image is a blueprint/template:

Images are typically treated as immutable — you usually rebuild a new image rather than modifying one in place.

Containers

A container is a running instance of an image.

One image can create many containers.

Registries

Registries store images (like GitHub for code).

How Containers Work

Containers use Linux kernel technologies:

Namespaces (Isolation)

Each container has its own view of:

Container can feel like it has its own little machine.

Cgroups (Resource Limits)

Control resource usage:

Prevents one container from hogging everything.

Layered Filesystem

Layer 4: Your app code       (writable container layer)
Layer 3: npm install         (shared image layer)
Layer 2: Node.js runtime     (shared image layer)
Layer 1: Ubuntu base         (shared image layer)

Layers are shared between images!

Benefits of Containers

Container Lifecycle

BUILD → PUSH → PULL → RUN → STOP → REMOVE

1. BUILD image       docker build → Image created
2. PUSH to registry  docker push → Available anywhere
3. PULL to server    docker pull → Image on server
4. RUN container     docker run → Application running
5. STOP when done    docker stop → Container stopped
6. REMOVE            docker rm → Container removed

Orchestration: Managing Many Containers

The Problem

Kubernetes

The industry standard orchestrator handles:

Common Mistakes

1. Fat Containers

Minimal containers start faster, use less space.

2. Running as Root

Container process as root increases risk. Run as non-root user.

3. Mutable State Inside Container

Container dies → Data lost. Use volumes for persistent data!

4. Using "latest" Tag

FAQ

Q: Containers vs serverless?

Q: Windows containers?

Yes! Windows has native container support. But Linux containers are more common.

Q: Are containers a strong isolation boundary?

They provide isolation but share the kernel. Depending on your threat model, you may want VM isolation too. Follow sensible hardening practices.

Q: Docker vs containers?

Docker is the most popular container runtime. Containers are the concept; Docker is one implementation.

Summary

Containers package applications with all dependencies for consistent, portable deployment.

Key Takeaways:

• Container = app + dependencies + config
• Lighter than VMs, share host OS kernel
• Same container works everywhere
• Fast to start, easy to scale
• Images are immutable blueprints
• Use orchestration (Kubernetes) for many containers
• Foundation of modern deployment

Containers greatly reduce "works on my machine" problems.