Advanced|22 hours|42 lessons

Container Internals and Runtime Engineering

A deep course on what happens beneath the container abstraction. Linux namespaces and cgroups, the OCI spec, image internals, container runtimes, isolation and escape paths, secure image builds, and container security at the runtime and kernel level. Built for senior engineers who need to understand and secure containers below the Kubernetes layer.

Text-based, no videos

8 modules, 42 lessons

Lifetime access

What you'll learn

What a container actually is at the kernel level: namespaces, cgroups, capabilities, and the filesystem that together create the illusion

Linux namespaces and cgroups in depth: what each isolates, how limits are enforced, and how a Kubernetes limit maps down to a cgroup

Container image internals: the OCI spec, layers and overlayfs, digests versus tags, and the image supply chain with signing and SBOMs

The runtime stack from containerd and CRI-O down to runc and crun, plus sandboxed runtimes (gVisor, Kata) and rootless containers

Container isolation and escape: why containers are not a security boundary, real escape techniques and CVEs, and runtime-level defense in depth

Secure image build systems: BuildKit, daemonless builds (Kaniko, Buildah), reproducible builds, and build caching at scale

Container networking and storage from the kernel up: veth pairs, bridges, the CNI layer, the writable layer, and system-level debugging

Container security at the runtime and kernel level: threat modeling, runtime hardening, seccomp engineering, secrets, and forensics

Two capstones: designing a secure multi-tenant container platform, and running a container security incident end to end

Curriculum

8 modules · 42 lessons

The Kernel Primitives

What a container actually is at the kernel level: namespaces, cgroups, capabilities, and the syscall filters that create the illusion.

5 lessons

What a Container Actually Is30 minFREE Namespaces, The Isolation Illusion30 minFREE cgroups, Controlling Resources30 minFREE Capabilities and the Root Illusion30 minFREE Seccomp, AppArmor, and SELinux30 minFREE

Container Images, What's Actually Inside

What you actually download when you pull an image: the OCI spec, layers and overlayfs, digests, registries, and the supply chain.

5 lessons

The OCI Image Spec30 min Layers and the Union Filesystem30 min Image Optimization, Why Size Matters30 min Content Addressable Storage and Registries30 min Supply Chain, Signing and SBOMs30 min

Container Runtimes

The runtime stack from containerd and CRI-O down to runc and crun, plus sandboxed and rootless runtimes.

5 lessons

The Runtime Landscape30 min runc and the OCI Runtime Spec30 min containerd Deep Dive30 min Sandboxed Runtimes, gVisor and Kata30 min Rootless Containers30 min

Isolation and Escape

Why containers are not a security boundary, real escape techniques and CVEs, and defense in depth at the runtime level.

5 lessons

Why Containers Are Not a Security Boundary30 min Container Escape Techniques30 min The Docker Socket and Other Foot-Guns30 min Defense in Depth for Containers30 min Runtime Threat Detection30 min

Image Build Systems

Secure, fast image builds: BuildKit, daemonless builds, reproducible builds, and caching at scale.

4 lessons

Beyond docker build, The BuildKit Era30 min Building Images Without a Docker Daemon30 min Reproducible and Deterministic Builds30 min Build Optimization at Scale30 min

Container Networking and Storage

Container networking and storage from the kernel up: veth, bridges, the CNI layer, the writable layer, and system-level debugging.

4 lessons

Container Networking From Scratch30 min The CNI Layer30 min Container Storage and Volumes30 min Debugging Containers at the System Level30 min

Container Security at the Runtime Level

Security strictly at the container, runtime, and kernel level: threat modeling, runtime hardening, seccomp engineering, secrets, and forensics. Not Kubernetes cluster controls.

6 lessons

The Container Threat Model30 min Hardening the Container Runtime30 min Kernel Attack Surface Reduction30 min Vulnerability Management for Images and Runtimes30 min Secrets at the Container Level30 min Container Forensics and Incident Response30 min

Production and Capstone

Production container engineering (performance, init, observability, lifecycle, migration) and two full design/incident capstones.

8 lessons

Container Performance Engineering30 min Init Systems and Signal Handling30 min Container Observability30 min The Container Lifecycle in Production30 min Windows Containers and Other Edge Cases30 min Migrating and Modernizing Container Infrastructure30 min Capstone A, Design a Secure Container Platform45 min Capstone B, Container Security Incident Walkthrough45 min

About the Author

Sharon Sahadevan

AI Infrastructure Engineer

Building production GPU clusters on Kubernetes. H100s, large-scale model serving, and end-to-end ML infrastructure across Azure and AWS.

10+ years designing cloud-native platforms with deep expertise in Kubernetes orchestration, GitOps (Argo CD), Terraform, and MLOps pipelines for LLM deployment.

Author of KubeNatives, a weekly newsletter read by 3,000+ DevOps and ML engineers for production insights on K8s internals, GPU scheduling, and model-serving patterns.

Ready to master this topic?

Start with the free preview lesson and see for yourself.