A Node.js service migrated to containers began experiencing intermittent timeouts and high CPU usage due to the default enableServiceLinks parameter injecting thousands of environment variables, and the analysis shows how to identify, reproduce, and resolve the issue with Kubernetes configuration and code adjustments.
This article introduces Docker's core architecture, common command-line tools, compares containers with traditional virtual machines, and explains the underlying Linux technologies—namespaces, cgroups, and union file systems—that enable lightweight, portable, and efficient containerization.
This guide explains Docker's core architecture, lists the most frequently used Docker commands, compares containers with traditional virtual machines, and dives into the underlying Linux technologies—namespaces, cgroups, and union file systems—that make containerization possible.
This guide explains why kubectl exec often fails under security best practices, introduces kubectl debug for creating ephemeral containers with root access, and explores additional methods such as kpexec and Appilot to troubleshoot running pods in Kubernetes clusters.
This tutorial walks through preparing a CentOS 8 server, uninstalling any existing Docker packages, adding a Tencent Cloud mirror, installing and starting Docker, configuring a non‑root Docker user group, and finally pulling, configuring, and running an Nginx container with essential HTTPS settings.
This article examines the security challenges of cloud‑native adoption, outlines a mature threat‑modeling methodology, and details how Alibaba Cloud's ACK and ACR services can be leveraged to implement a comprehensive DevSecOps pipeline that secures the entire application lifecycle.
The Java service crashed when the Linux OOM killer terminated its process after a developer opened a 37 GB log file with Vim, which loaded the entire file into the container’s 8 GB memory, triggering a port alarm and prompting investigation and recommendations to use streaming tools instead of Vim.
This guide shows how to run a vsftpd Docker container, configure ports and volumes, install the PHP ftp-client library via Composer, and use PHP code to upload and download files through the container’s internal network.
This article presents a detailed case study of a leading AI‑driven quant investment firm that leveraged Alibaba Cloud ACK's FinOps suite to tackle planning, allocation, management, and optimization challenges in Kubernetes‑based container workloads, achieving up to 25% cost reduction and significantly higher resource utilization.
The forum held on October 25, co‑organized by China Financial Computer magazine and Ant Group, gathered experts from eleven financial institutions to share cloud‑native and green‑computing practices—including distributed stacks, hybrid deployments, secure containers, serverless, and continuous profiling—aimed at advancing low‑carbon, high‑quality compute in the financial sector.
This guide explains how to write efficient Dockerfiles by using .dockerignore, minimizing layers, combining RUN commands, selecting lightweight base images, cleaning up after installations, setting proper WORKDIR and CMD, leveraging ENTRYPOINT with exec, preferring COPY over ADD, and applying multi‑stage builds to achieve faster builds and smaller, more maintainable images.
This article explains how to use Dockerfiles to customize Docker images, covering base image selection, RUN, COPY, ADD, CMD, ENTRYPOINT, ENV, VOLUME, EXPOSE, and WORKDIR instructions, along with best practices for layer optimization, build context handling, and efficient image construction.
The article analyzes why a Java service repeatedly crashes around midnight in test environments, tracing the issue through system limits, Java version checks, cron job execution, strace logs, and Linux OOM killer behavior, and finally proposes configuration and version upgrades to prevent the failures.
The article walks through building a minimal Go‑based container from the ground up, explaining essential container concepts such as Linux namespaces, cgroups, and PivotRoot, and providing step‑by‑step code for creating isolated processes, configuring resource limits, and assembling a functional, lightweight container environment.
This article explains Docker fundamentals, compares containers with virtual machines, details Docker’s core components and common commands, and provides complete step‑by‑step instructions for packaging, building, running, automating, and pushing both a Vite‑based React frontend and an Express‑based Node.js backend using Nginx and shell scripts.
This article explains why beginner Docker images can exceed 1 GB, then walks through multi‑stage builds, static versus dynamic linking, language‑specific tricks, and the use of minimal base images like scratch to reduce image size by over 99 % while preserving functionality.
This article explains the fundamentals of Docker image layers, demonstrates how to analyze layer size with tools like docker history and dive, and provides practical optimization techniques—including multi‑stage builds, cache removal, layer squashing, and metadata‑aware copying—to dramatically reduce image footprints.
The article details a production incident where a containerized Java service experienced a CPU surge due to frequent young and full garbage collections, describing step‑by‑step diagnostics using Linux tools, jstack analysis, and code fixes that ultimately resolved the issue.
This article explains how Linux ulimit and cgroup mechanisms can be used to restrict file descriptors, memory, and thread counts in containerized environments, compares Docker and Kubernetes configurations, presents experimental results on fd and thread limits, and offers practical recommendations for configuring default‑ulimits, pod‑max‑pids, and system limits.
This tutorial explains how to use Dockerfile to customize images, covering essential instructions such as FROM, RUN, COPY, ADD, CMD, ENTRYPOINT, ENV, VOLUME, EXPOSE, and WORKDIR, with practical examples, best‑practice tips, and details on build context and image layering.
This article explains the fundamentals of Kubernetes Pods, covering their definition, creation methods, container count, networking model, storage options, and provides essential kubectl commands for managing Pods and deployments.
The vivo Internet Container Team built a scalable, high‑availability container monitoring platform by deploying dual‑replica Prometheus clusters with a custom HA adapter, remoteWrite to VictoriaMetrics, and a Kafka forwarder, while cutting metric cardinality, tuning cAdvisor, and upgrading VictoriaMetrics to eliminate data loss and storage spikes, achieving stable, efficient monitoring.
This comprehensive Docker guide covers fundamental concepts, common use cases, installation steps, storage configuration, image management, container creation, networking modes, volume handling, private registry setup, backup strategies, and MySQL deployment, providing practical commands and explanations for developers and ops engineers.
This guide explains what the nsenter command does, how it can be used to enter a container's network, mount, or other namespaces, and provides practical examples and underlying principles such as Linux namespaces, clone, and setns for effective container troubleshooting.
This guide explains practical Dockerfile optimization techniques—including using .dockerignore, minimizing layers, choosing lightweight base images, consolidating RUN commands, setting proper WORKDIR/CMD, leveraging ENTRYPOINT with exec, preferring COPY over ADD, and applying multi‑stage builds—to dramatically speed up image builds and reduce final image size.
Docker Buildx Bake is a powerful Docker CLI extension that enables declarative, multi‑platform image builds with parallel execution, cache optimization, and flexible output formats, and this guide explains its concepts, advantages, usage steps, and advanced features for efficient container image management.
This article examines the problems of a bloated Docker deployment, explains how to build a minimal service base image, construct a clean Docker Compose‑based deployment architecture, and implement automated rolling updates using Docker Swarm, Kubernetes and shell scripts.
This article explains how to use a Dockerfile to customize Docker images, covering the purpose of each instruction such as FROM, RUN, COPY, ADD, CMD, ENTRYPOINT, ENV, VOLUME, EXPOSE, and WORKDIR, and provides practical examples and best‑practice tips for building efficient, minimal images.
This guide explains why Docker network IP address conflicts occur and provides step‑by‑step commands to locate duplicate IPs, stop conflicting containers, manually reassign IPs, and fully clean and restart the Docker environment to eliminate the issue.
This article explains what multi‑architecture Docker images are, why they are useful, and provides step‑by‑step instructions for building them with traditional Docker commands or Docker buildx, integrating the builds into Jenkins and GitHub Actions pipelines, promoting images across environments, scanning for vulnerabilities, and important considerations to keep in mind.
This guide explains why smaller Docker images improve security, transfer speed, and deployment time, and walks through ten practical techniques—including layer minimization, Docker‑squash, slim base images, multi‑stage builds, apt flags, .dockerignore, and specialized tooling—to reliably reduce image size.
OrbStack provides a zero‑configuration, free virtualization solution on macOS that replaces Docker Desktop and traditional Linux VMs with faster startup, lower CPU and memory usage, seamless Docker integration, and a full Linux environment, making development on Apple Silicon both efficient and effortless.
This guide explains why Docker image size matters for CI/CD and cloud deployments, then details ten practical methods—including layer minimization, multi‑stage builds, slim base images, apt flags, .dockerignore, and specialized tools—complete with code snippets and visual comparisons to help you create leaner containers.
This guide explains why Docker network IP address conflicts occur, how to diagnose issues such as dockerd failing to start or container ports being unreachable, and provides step‑by‑step solutions including checking logs, adjusting subnet settings, editing daemon.json, and recreating the ingress network to restore normal operation.
This article provides a comprehensive guide to Podman, covering its definition, key differences from Docker, essential CLI commands for containers and images, installation steps, registry accelerators, rootless operation, user namespace handling, volume usage, and configuration files for effective container management on Linux systems.
Understanding container exit codes—from 0 for normal termination to 255 for unknown errors—helps diagnose pod failures in Docker and Kubernetes, covering each code’s meaning, typical causes, and step‑by‑step troubleshooting actions to resolve issues such as command errors, permission problems, signals, and resource limits.
This article explains why UDP packets sent from a Docker bridge network to a host‑bound UDP server become unreachable, analyzes the root cause in Linux’s source‑address selection, and provides practical fixes such as binding to a specific interface or using IP_PKTINFO with recvmsg/sendmsg.
This article explains the motivation behind hybrid mobile development, outlines its overall architecture including offline package management and container systems, details the tooling and release process, and summarizes the practical benefits observed after deployment.
This tutorial explains what a PHP container is, why containers are useful for modern DevOps, and provides step‑by‑step instructions—including Dockerfile creation, image building, and container execution—to package a PHP 7.4 application with Nginx using Docker.
This article explains why a UDP service listening on 0.0.0.0 inside a Docker bridge network becomes unreachable, analyzes packet captures and kernel routing behavior, and provides practical solutions such as using TCP, binding to a specific interface, or enabling IP_PKTINFO on the socket.
This article walks you through downloading the MySQL 5.7 Docker image, configuring IPv4 networking, launching the container with proper volume mounts, troubleshooting common startup errors, verifying the setup, and discussing production‑grade considerations such as data persistence, memory isolation, and scaling.
This article explains how to enable Kubernetes audit logging, analyzes CDK‑based attack behaviors captured in audit logs, provides concrete detection rules for information collection, exploitation, and privilege escalation, and shares practical lessons learned when deploying audit‑driven security in cloud‑native environments.
The OpenKruise v1.4 release introduces the Job Sidecar Terminator for automatic sidecar shutdown, enables several stable capabilities by default, adds CloneSet performance and lifecycle improvements, provides a force‑recreate option for containers, and enhances image pre‑pull metadata handling, all while offering clear usage examples and configuration snippets.
This article explains why Kubernetes health probes are essential, describes the three probe types (liveness, readiness, startup), their checking methods, configuration options, provides complete YAML examples, demonstrates testing scenarios, and outlines additional mechanisms that ensure container availability in a cloud‑native environment.
This article explains how to correctly obtain CPU utilization inside containers, compares host and container metrics, describes the use of lxcfs and cgroup files (including cgroup V1/V2) for accurate measurement, and clarifies why container statistics omit nice, irq, and softirq fields.
This article explains how Linux cgroup’s CPU controller works, covering the creation of cgroups, the kernel structures involved, how CPU time limits are configured via cfs_period_us and cfs_quota_us, how processes are attached to cgroups, and the scheduling mechanisms that enforce bandwidth limits in containers.
This article traces Zhuanzhuan's evolution of log collection—from a bare‑metal scribe + flume pipeline, through a container‑aware log‑pilot solution, to a cloud‑native filebeat and fb‑advisor architecture—detailing the motivations, technical designs, performance gains, and trade‑offs of each stage.
This article explains Linux signal fundamentals, common signal types, and how Docker's ENTRYPOINT and CMD directives affect signal propagation, demonstrating with Go examples why using the exec form and proper script handling enables containers to terminate gracefully instead of being force‑killed.
This article explains the unique characteristics of Serverless Containers, how they impact Kubernetes architecture, Alibaba Cloud's ECI implementation, the design of Serverless Kubernetes, its limitations, scalability challenges, and the strategies used to address them.
This article provides a comprehensive guide to Docker container networking, covering the default networks, the four network modes (bridge, host, none, container), virtual Ethernet pairs, Linux network namespaces, and practical configuration examples such as port mapping and custom bridge creation.
iQIYI’s video transcoding team cut its Docker image size from 18 GB to 9 GB and build time from 30 minutes to under five by layering differential builds, on‑demand downloads, library deduplication, node pre‑warming with gray releases, and P2P distribution via Dragonfly, all without requiring developer changes.
DeWu’s container SRE team combines software‑engineered reliability with routine operations, using defined on‑call roles, SLO/SLA targets, progressive change management, capacity forecasting, four‑metric monitoring, MTTR/MTTF tracking, kernel‑parameter tuning, and namespace‑protected security policies to swiftly resolve incidents such as Redis latency spikes.
This article explains how Linux's ulimit and cgroup mechanisms can be used to restrict file descriptors and thread counts in Docker and Kubernetes environments, compares configuration methods, presents experimental results, and offers practical recommendations for setting limits at the container, pod, and host levels.
Since JDK 9, Java has accelerated its release cadence and added a suite of cloud‑native capabilities—such as container‑aware metrics, single‑file execution, refined JVM options, fast‑fail memory controls, class‑data sharing, compact strings, active‑processor detection, and Unix‑domain sockets—to better serve modern containerized workloads.
This article compiles common Docker interview questions and provides detailed explanations, covering Docker fundamentals, use cases, advantages, differences from virtual machines, core components, installation steps, storage configuration, image management, container creation, networking modes, data volumes, private registry setup, backup procedures, and MySQL deployment, all illustrated with practical command examples.
Learn practical Dockerfile optimization techniques—including clean build contexts, choosing minimal base images, configuring Chinese mirrors, setting time zones, consolidating RUN commands, using virtual build environments, and minimizing layers—to dramatically reduce image size and improve build efficiency.
This article investigates intermittent Java Agent errors caused by Instrumentation.appendToSystemClassLoaderSearch in container environments, tracing the issue through JNI calls, glibc stat failures, locale‑dependent iconv conversion, and ultimately fixing it with pthread thread‑local storage and proxy wrappers.
Vivo’s cloud‑native journey, detailed from its 2018 machine‑learning pilot to a large‑scale container ecosystem, showcases how high‑availability design, automated multi‑cluster operations, CI/CD pipelines, and unified traffic ingress have dramatically improved efficiency, reduced costs, and enabled rapid, scalable AI‑driven services across the business.
This guide introduces Tipi, an open‑source home‑server management tool that launches services in containers with a click, and provides step‑by‑step commands to download and start the platform, plus a link to its documentation.
This article explains Docker's built‑in container networking, describing the three default networks, the four network modes (bridge, container, host, none), how to inspect and configure them with commands, use veth pairs and network namespaces, and perform common container operations such as port mapping and custom bridge creation.
This guide details Docker's built‑in network drivers, explains the four primary network modes—bridge, host, container, and none—covers creating and managing network namespaces, veth pairs, custom bridges, and common container operations such as port mapping, DNS configuration, and hostname handling.
The 2022 Vivo developer conference showcased a series of technical breakthroughs—including a custom wepy‑chameleon compiler for frontend upgrades, low‑code platforms for backend and game development, a real‑time computing platform built on Flink, advanced graph scheduling, cloud‑native container strategies, monitoring enhancements, database automation, and large‑scale messaging middleware—highlighting Vivo's comprehensive push toward efficiency and innovation across its internet services.
Learn practical Dockerfile optimization techniques—including clean build contexts, selecting minimal base images, configuring domestic package mirrors, setting correct timezones, using virtual build environments, minimizing image layers, and consolidating file additions—to dramatically reduce image size, improve build speed, and avoid common pitfalls.
This guide walks you through installing Podman on CentOS 8, configuring user namespaces, creating and building a custom UBI‑based image with a Dockerfile, running containers, verifying installed tools, using interactive shells, and mounting host directories for persistent storage.
This article surveys seven Docker alternatives—Podman, LXD, Containerd, Buildah, BuildKit, Kaniko, and RunC—detailing their architectures, key features, security models, and how they differ from Docker for container creation, management, and orchestration.
This article explains why Docker containers often stop right after starting by examining the Linux PID 1 init process, the behavior of foreground versus daemonized commands in Dockerfiles, and how container runtimes like containerd‑shim and runc manage the container’s main process.
This article provides a comprehensive overview of Docker's client‑server architecture, detailing the roles of Docker Client, Daemon, Engine, jobs, Registry, Graph database, drivers, libcontainer library, and how they collectively enable container creation, image management, networking, and resource control.
This article provides a detailed overview of Docker, covering its definition, core components, advantages over virtual machines, common use cases, installation steps, storage configuration, image management commands, network modes, data volumes, private registry setup, backup procedures, and MySQL deployment, all illustrated with practical command examples.
This article explains Docker's built‑in networking, details the four network modes (bridge, host, container, none), shows how to inspect and configure networks with commands like docker network, ip netns and veth pairs, and provides practical examples for port mapping, DNS, and custom bridge creation.
This article explores how Kubernetes Pods differ from simple containers by examining their underlying implementation, shared network and IPC namespaces, cgroup hierarchies, and the role of the pause sandbox, while also demonstrating how similar pod-like behavior can be achieved using Docker and cgroup tools.
The nightly service latency spikes were traced to major page faults triggered by the category client’s lazy mmap of a 1.7 GB off‑heap store during package switches, not to GC or CPU throttling, and were resolved by upgrading to a version that pre‑loads the store in 64 MB chunks with brief pauses.
This comprehensive guide explains how to create and customize Docker images using Dockerfile, covering base image selection, RUN, COPY, ADD, CMD, ENTRYPOINT, ENV, VOLUME, EXPOSE, and WORKDIR instructions, along with best practices for layer optimization and context handling.
This comprehensive guide explains what a Dockerfile is, its four-part structure, common instructions such as ARG, FROM, RUN, COPY, and ENTRYPOINT, and provides detailed examples of building images, running containers, and testing CMD, ENTRYPOINT, command, and args interactions in Kubernetes.
This article provides a comprehensive guide to diagnosing and fixing a wide range of Docker problems, including storage migration, disk space shortages, missing libraries, container corruption, network configuration, permission errors, image management, and timeout issues, with detailed command-line solutions and configuration examples.
The article introduces the ZuanZuan cloud platform, detailing its overall architecture, image management workflow that abstracts Dockerfiles, release‑upgrade strategies with custom controllers, container monitoring evolution to Prometheus, and log‑collection mechanisms that handle large Java‑based log volumes.
This guide explains Docker’s built‑in health‑check feature, covering process‑level checks, Dockerfile HEALTHCHECK syntax, runtime options with docker run, and health‑check configuration in docker‑compose, complete with practical examples and troubleshooting tips.
This guide provides step‑by‑step instructions for installing Docker on CentOS and Ubuntu, configuring image accelerators for faster pulls, and using Docker commands to pull, run, list, and clean up images and containers, including tips for handling dangling and intermediate layers.
A Docker security flaw allows services bound to the loopback address with -p 127.0.0.1 to be reachable from external hosts due to an iptables rule, and the article explains the issue, demonstrates a proof‑of‑concept, and proposes tightened firewall rules as a fix.
This comprehensive guide walks you through installing Docker on various operating systems, configuring image accelerators for faster pulls, and mastering Docker image management—including pulling, running, listing, filtering, and cleaning up images and containers—while addressing platform‑specific considerations.
This article explains what Docker container exit codes mean, how to view them using Kubernetes or Docker commands, and details the most common codes such as 0, 1, 137, 139, and 143, helping you diagnose why a container is not running.
This article defines cloud native, traces its evolution from early cloud computing to modern containers and Kubernetes, outlines its core principles, and introduces representative technologies such as containers, service meshes, and microservices, highlighting current trends and future directions.
Knative is a CNCF‑incubated, cloud‑native serverless framework on Kubernetes that combines Build, Eventing, and Serving components—featuring a Knative Pod Autoscaler that can scale pods to zero—offering improved resource utilization, rapid traffic response, and developer productivity despite modest performance overhead.
This guide provides step‑by‑step instructions for installing Docker on CentOS and Ubuntu, configuring accelerated image mirrors, managing Docker images—including listing, tagging, and removing—while covering essential commands, storage considerations, and best practices for both systemd and upstart environments.
This article explains the fundamentals of Docker container technology, covering the role of Linux namespaces for process isolation, control groups for resource limiting, and UnionFS-based image layering, while providing practical command examples and code snippets for creating and managing containers.
This guide explains Dockerfile fundamentals, walks through each core instruction with practical examples, demonstrates building images for simple CentOS containers, SpringBoot applications, and shows how to tag, push, and pull images from a registry, providing clear step‑by‑step commands and explanations.
This article introduces Loki, Grafana Labs' open‑source, horizontally scalable log aggregation system, compares it with ELK/EFK, explains its architecture and components, and provides step‑by‑step deployment instructions with Promtail configuration and Grafana integration for Kubernetes environments.
This tutorial explains how to configure Docker on a Kubernetes node to transparently use a remote Docker daemon by modifying the systemd service, creating a custom Docker image with helper scripts, and committing it, so users can run Docker commands without explicitly specifying the remote host.
An exposed Docker security flaw allows services bound to 127.0.0.1 via the -p flag to be accessed externally through iptables rules, as demonstrated by a PostgreSQL container proof‑of‑concept, and the article proposes stricter iptables configurations and default localhost binding to mitigate the risk.
The article explains how Nydus’s new RAFS v6 image format, built on the kernel‑native EROFS filesystem and integrated with fscache, overcomes the performance and scalability limitations of traditional OCIv1 and user‑space container image solutions by enabling kernel‑mode on‑demand loading, fine‑grained chunk deduplication, asynchronous prefetching, and superior I/O efficiency, with benchmark results demonstrating near‑native speeds.
This article explains what a Kubernetes pod is, why pods are needed instead of single containers, how the pause container enables shared namespaces, common pod deployment patterns, step‑by‑step creation with kubectl, and the detailed lifecycle and creation workflow of pods.
This article explains how to create a nested Kubernetes cluster (VMLC) inside a pod using SmartIDE, covering the motivations, required tools, Azure AKS setup, sysbox runtime installation, VMLC deployment, VS Code WebIDE and hybrid SSH access, building and deploying a Dapr sample, and clean‑up procedures.
Learn how to enable IntelliJ IDEA’s built‑in Docker plugin, configure remote Docker connections, manage images and containers, build custom Docker images from a SpringBoot project, and deploy the application using Docker Compose—all without leaving the IDE.
This article explains Linux signals, their role in Docker container shutdown, and demonstrates with Go and shell examples how using the exec form in Dockerfile ENTRYPOINT/CMD ensures containers receive termination signals for a clean exit.
The article examines the advantages and disadvantages of deploying container cloud platforms on bare‑metal servers versus virtual machines in the financial sector, covering performance, cost, management, security, workload suitability, and practical recommendations for banks based on their IaaS capabilities.
This guide introduces a versatile task‑scheduling panel supporting Python 3, JavaScript, Shell, and TypeScript, outlines its key features, and provides step‑by‑step deployment instructions for Podman, Docker, and Docker‑Compose, including command examples and usage tips.
This article provides an in‑depth comparison of Podman and Docker, covering their architectures, root‑less operation, security, integration with Kubernetes, support for Swarm/Compose, and practical guidance on when to choose or combine each container solution.
This article shares the author’s experience designing UC Browser’s next‑generation web container, examining its technical boundaries—such as complex media control, high‑performance long lists, parallax interactions, multi‑tab pages, and modal dialogs—and discusses when web, native, or Flutter solutions are most appropriate.
This article provides a comprehensive introduction to virtualization technologies, covering historical background, full and half virtualization, hardware‑assisted virtualization, KVM‑QEMU, GPU and I/O virtualization, and container solutions such as LXC and Docker, while highlighting their roles in modern cloud computing.
The article examines how rapid cloud‑native adoption reshapes application design and operations while introducing six distinct security risks, and proposes a comprehensive DevSecOps framework that integrates early‑stage security controls across infrastructure, compute, development, and management to protect modern containerized environments.
This tutorial walks readers through the evolution of web deployment, explains core Kubernetes concepts, and provides step‑by‑step instructions for using kubectl to create Ingress, Service, and Deployment resources that run a multi‑instance Node.js backend, culminating in a functional K8S deployment workflow.
