04. Docker Architecture: Namespaces, Cgroups, UnionFS & Docker Engine Internals • DevOps, Docker & Cloud VPS Deployment Mastery • Rishabh Ki Kaksha

DevOps, Docker & Cloud VPS Deployment Mastery › 04. Docker Architecture: Namespaces, Cgroups, UnionFS & Docker Engine Internals

45 mins

← Prev Next →

Course Syllabus

Module 1: Linux System Administration & Kernel Performance Tuning

01. Linux OS Architecture: Kernel vs User Space, System Calls & Process Management (ps, top, htop) 02. Linux File Permissions (chmod, chown, SUID/SGID) & Sticky Bits Security 03. Networking & Diagnostics: netstat, ss, lsof, tcpdump, curl, dig & DNS Resolution

Part 1: Linux & Docker Containerization

Module 2: Containerization with Docker & Multi-Stage Builds

04. Docker Architecture: Namespaces, Cgroups, UnionFS & Docker Engine Internals 05. Dockerfile Optimization: Layer Caching, Non-Root Users & Ultra-Light Alpine Multi-Stage Builds 06. Docker Compose: Multi-Container Networking, Persistent Volumes & Environment Config 07. Docker Production Security: Read-Only Root FS, Capabilities Drop & Container Scanning

Part 2: Nginx, SSL, PM2 & Automated CI/CD

Module 3: Nginx Reverse Proxy, SSL Automation & Security Hardening

08. Nginx Masterclass: Event-Driven Non-Blocking Architecture vs Apache Multi-Threaded 09. Nginx as Reverse Proxy, Load Balancer (upstream) & Gzip/Brotli Compression Config 10. SSL/TLS Automation with Certbot Let's Encrypt, HTTP/2 & Strict-Transport-Security (HSTS) 11. Nginx Rate Limiting (limit_req), DDoS Mitigation & Security Headers Injection

Module 4: Process Management with PM2 & Systemd Services

12. Systemd Services: Creating Custom System Daemons with Automatic Restart & Logging 13. PM2 Enterprise Process Manager: Cluster Mode, Ecosystem Config & Graceful Reloads 14. Log Management & Rotation: logrotate, journalctl & Centralized Syslog Streaming

Module 5: CI/CD Automation with GitHub Actions & Zero-Downtime Deployments

15. CI/CD Foundations: Building Automated Test & Build Pipelines with GitHub Actions 16. Automated SSH Deployments: Self-Hosted Runners, Deploy Keys & Zero-Downtime Atomic Symlinks 17. Blue-Green & Canary Deployment Strategies on Cloud VPS Infrastructure

Module 6: Cloud VPS Production Hardening, Firewall (UFW) & Backups

18. Cloud VPS Hardening: Non-Root Sudo Users, SSH Key-Only Auth, Fail2ban & UFW Firewall Rules 19. Automated Database & Media Backups to Cloud Storage (AWS S3 / Cloudflare R2 / MinIO) 20. Server Health Monitoring & Alerting: Uptime Kuma, Netdata, Prometheus & Telegram Bot Webhooks

Interactive Lesson Studio

# 04. Docker Architecture: Namespaces, Cgroups, UnionFS & Docker Engine Internals

> DevOps & Cloud VPS Notes by Rishabh - Topic 04

---

### 1. Containers Are Not Virtual Machines! 🐳

*   **Virtual Machine (Hypervisor - Type 1/2):** Poora separate Guest OS, Virtual Kernel, Virtual Hardware simulate karta hai (~GBs RAM, minutes startup).
*   **Docker Container:** **Host Linux Kernel ko directly share karta hai!** It is just an isolated process bounded by 3 Linux primitives:

```
┌─────────────────────────────────────────────────────────────┐
│                 DOCKER CONTAINER ISOLATION                  │
├───────────────────┬─────────────────────────────────────────┤
│ 1. NAMESPACES     │ Isolation (What the process can SEE)    │
│ 2. CGROUPS        │ Limitation (What the process can USE)   │
│ 3. UNIONFS        │ Layered Copy-on-Write Filesystem (Storage)│
└───────────────────┴─────────────────────────────────────────┘
```

---

### 2. The 6 Linux Namespaces Inside Docker

1. **`pid`:** Process ID isolation (Container process thinks it is PID 1).
2. **`net`:** Virtual network interfaces & routing tables.
3. **`mnt`:** Mount points & isolated root filesystem (`chroot` on steroids).
4. **`ipc`:** Inter-Process Communication shared memory isolation.
5. **`uts`:** Hostname and domain name isolation.
6. **`user`:** UID/GID mapping (Maps container root to unprivileged host user).

---

### 3. Control Groups (cgroups v2): Resource Limits ⚖️

```bash
# Run container capped at 2 CPU cores and 512MB RAM:
docker run -d --cpus="2.0" --memory="512m" --memory-swap="512m" --name web-api my-node-app
```

---

### 4. Master Comparison Matrix

---

### 5. Interview Ke 3 Sawal Is Topic Se

1. **UnionFS (OverlayFS) me Copy-on-Write (CoW) kaise kaam karta hai?** -> Image layers read-only hoti hain; container jab kisi file ko modify karta hai toh OverlayFS us file ko upper read-write container layer me copy karke modify karta hai bina base image layer ko mutate kiye.
2. **`containerd` aur `runc` Docker architecture me kya karte hain?** -> `containerd` container lifecycle aur image pull manage karta hai; `runc` OCI low-level standard runtime hai jo Linux namespaces aur cgroups create karke container process start karta hai.
3. **OOM Killer (Out-of-Memory Killer) container me kab trigger hota hai?** -> Jab container apni assigned cgroup memory limit (`--memory`) exceed karta hai, Linux kernel process ko kill kar deta hai (Exit Code 137).

---
**Next Topic:** 05. Dockerfile Optimization: Layer Caching, Non-Root Users & Ultra-Light Alpine Multi-Stage Builds

Loading lesson content...

Python 3.12

Full IDE

Live Execution Terminal

Click "Execute Live" to run code.
                

Lesson Mastery AI Quiz

AI Doubt Solver

CERTIFICATE OF COMPLETION

Rishabh Gehlot

PHP 8+ & Laravel 11 Master Track