Apple Container 1.0, an open‑source Linux container tool for Apple Silicon macOS 26, replaces Docker Desktop's shared VM with per‑container lightweight VMs, offering sub‑second startup, about 30% less idle memory, a persistent Container Machine environment, and detailed migration guidance.
Apple Container is an open‑source Swift CLI that runs Linux containers on Apple‑Silicon Macs via per‑container lightweight VMs, offering OCI compatibility, faster startup, better memory use, native networking, and strong isolation compared with Docker Desktop, while detailing system requirements, installation steps, and macOS 15 limitations.
Oracle announced that Safra Catz will share the CEO role with Clay Magouyrk and Mike Sicilia, a move aimed at strengthening its cloud infrastructure and AI capabilities, while highlighting record financial performance and outlining the strategic importance of OCI, AI-driven growth, and the company's involvement in rebuilding TikTok's algorithm for U.S. security.
This article explains how Alibaba Cloud ACK One's ModelDistribution leverages OCI images to standardize, version, and efficiently distribute large AI models across multiple Kubernetes clusters worldwide, addressing challenges of storage, deployment speed, and pre‑warming for rapid inference services.
Oracle disclosed that attackers stole data from its legacy Cloud Classic servers, posted the breach on security forums, and claimed millions of records were compromised, while the company insists its Oracle Cloud Infrastructure was never breached, prompting widespread criticism and concern.
This article provides a comprehensive overview of container technology, covering its definition, key characteristics, historical evolution from early virtualization to modern Docker and Kubernetes ecosystems, core Linux mechanisms such as cgroups and namespaces, runtime implementations, OCI standards, security enhancements, and container orchestration.
FreeBSD 14.2‑RELEASE, the latest BSD version dedicated to Michael J. Karels, introduces OpenZFS 2.2.6, OpenSSL 3.0.15, enhanced OCI‑compatible container support with Podman tooling, and a streamlined upgrade process, while also highlighting remaining challenges such as GPU issues and desktop installer limitations.
This article explains the Open Container Initiative (OCI) standards—Image-spec, Distribution-spec, and Runtime-spec—detailing how code is built into OCI images, pushed to registries, and executed via Kubernetes components such as kubelet, containerd/CRI‑O, and runc or kata‑containers, ensuring portable, interoperable containers.
This article explains how Kubernetes uses the device‑plugin framework to extend resources beyond CPU and memory, details the kubelet registration and allocation workflow, and walks through the relevant source code in pkg/kubelet/cm/devicemanager that builds the OCI spec.
This article explains containerd’s role in Docker, outlines its core responsibilities and design goals, shows how to install and configure it on Ubuntu, and provides a complete Go example that pulls a Redis image, creates a container, runs and cleans up the task.
This article explains the role of container runtimes, distinguishes low‑level, high‑level, and sandbox runtimes, and compares three major implementations—containerd, CRI‑O, and Docker—detailing their architecture, image handling, networking, storage, and integration with OCI specifications.
Podman, a daemonless OCI‑compatible container engine created by Red Hat, offers rootless operation, tighter security, and direct runtime interaction, positioning it as a compelling alternative to Docker while its broader adoption depends on ecosystem maturity and community support.
This article explains the role of container runtimes, classifies them into low‑level, high‑level, and sandbox types, and details the architectures and key components of popular runtimes such as containerd, CRI‑O, and Docker, highlighting their interactions with OCI specifications and system resources.
This article provides a comprehensive guide to Podman, covering its definition, key differences from Docker, essential CLI commands for containers and images, installation steps, registry accelerators, rootless operation, user namespace handling, volume usage, and configuration files for effective container management on Linux systems.
This article introduces Podman, an open‑source, daemon‑less container runtime compatible with Docker, explains its architectural differences, rootless operation, configuration files, common commands, image handling, volume usage, and practical tips for Linux environments.
By profiling the OCI runtime with hyperfine and applying a series of kernel patches, seccomp hash optimizations, and BPF compilation caching, the author reduced container start‑up time from roughly 160 ms in 2017 to just over 5 ms today—a near 30‑fold speedup.
The containerd project completed a comprehensive fuzzing audit that added 28 fuzzers, uncovered a critical OCI image import vulnerability (CVE‑2023‑25153), and demonstrated the robustness of its codebase while highlighting the importance of fuzz testing for cloud‑native runtime security.
Sealer 0.9 introduces a cluster‑centric model for building, sharing and running distributed applications, adds Sealer Image types, enriches Kubefile with LABEL, KUBEVERSION, APP, CNI, CSI, APPCMDS and LAUNCH directives, and outlines future roadmap and community resources.
The article explains how Distribution, an OCI‑compliant artifact registry, implements three authentication strategies—htpasswd, silly, and token—detailing their configuration formats, runtime checks, and request‑handling flows.
This article explains the key components and standards of the container ecosystem—including Docker, containerd, CRI‑O, OCI and runc—detailing how they interact, the role of the Container Runtime Interface, and why Docker is only a small part of a broader, interoperable cloud‑native landscape.
This article explains what Podman is, highlights its key architectural differences from Docker, provides Docker‑compatible command references, shows how to install and configure accelerators, demonstrates rootless operation, and covers essential configuration files and volume handling for secure container management on Linux.
This article provides a comprehensive overview of Podman, an open‑source, daemon‑less container runtime, comparing it with Docker, detailing its architecture, installation, configuration, common commands, image building, registry acceleration, user namespace setup, volume handling, and rootless port mapping for Linux systems.
This article explains how to programmatically parse container images using Google's go‑containerregistry library, covering basic concepts such as ImageIndex, Image Manifest, layers, and diffIDs, and demonstrates retrieving image metadata, system packages, and Java application dependencies through code examples and practical Go snippets.
This article introduces Podman, an open‑source container runtime that runs without a daemon or root privileges, compares its architecture and features with Docker, and provides detailed instructions for installation, configuration, common commands, image management, volume handling, and user‑namespace setups on Linux.
RunC, the OCI‑compliant low‑level container runtime originally derived from Docker’s libcontainer, works alongside high‑level runtimes like containerd and cri‑o, and this article explains its origins, lifecycle states, usage commands, and how it fits into the broader cloud‑native container ecosystem.
This guide explains how runc implements the OCI runtime spec, walks through creating an OCI bundle, using skopeo and umoci to fetch images, and demonstrates running containers in foreground and detached modes while highlighting the underlying Linux namespace mechanics.
Inclavare Containers, the first open‑source container runtime for confidential computing, became a CNCF sandbox project in September 2021, integrates with Kubernetes and Docker, offers zero‑trust, remote attestation, OCI compatibility, and aims to standardize secure cloud‑native workloads across clouds.
The article explains the history of containers, the role of Docker and Kubernetes, why Kubernetes is deprecating Docker's dockershim, the timeline for the change, its impact on users, and the steps required to migrate to OCI‑compatible runtimes such as containerd or CRI‑O.
This article explains four practical methods for moving thousands of Docker registry images to a Harbor instance, covering image listing, project creation, and migration techniques ranging from simple Docker retagging to advanced skopeo and storage‑directory approaches.
This article explains the evolution and inner workings of Kubernetes container runtimes, detailing the roles of CRI, OCI, Docker, containerd, CRI‑O, and strong‑isolation solutions like Kata, gVisor, and Firecracker, and why the default dockershim remains prevalent.
This article explains the background of containers, compares Docker and Kubernetes, details the deprecation of Docker's dockershim in Kubernetes v1.20, outlines the impact on developers and operators, and provides practical steps for migrating to OCI‑compatible runtimes.
Alibaba’s open‑source DADI project introduces the overlaybd image format, which uses block‑level on‑demand reads, iSCSI targets, and a ZFile compression scheme to cut container cold‑start times by up to five times, offering a scalable solution for cloud‑native workloads.
Helm v3.5 introduces extensive OCI support, over 20 new template functions, and several useful command‑line flags such as --skip-refresh, wait-for-jobs, and --kube-cafile, while also migrating Helm Hub to Artifact Hub, making chart management more flexible and secure.
This article explains the evolution and inner workings of Kubernetes container runtimes, covering the classic Docker‑based flow, the roles of CRI, OCI, containerd, CRI‑O, and strong‑isolation solutions like Kata, gVisor, and Firecracker, while clarifying why the architecture became so layered.
While Docker once dominated container workflows, a growing ecosystem of tools—such as Podman, Buildah, Kaniko, BuildKit, and various runtimes—offers daemon‑less, root‑less, OCI‑compatible alternatives for building, running, and distributing images, and this guide compares their features, commands, and use cases.
This article examines why Docker is no longer the sole container engine, compares alternatives like Podman, Buildah, Kaniko, and BuildKit, and explores container runtimes and image inspection tools, helping readers choose the best tools for their workflows.
Kubernetes 1.20 marks the deprecation of Docker support, explaining that Docker’s heavyweight nature and the maintenance burden of the dockershim layer drove the change, while reassuring developers that OCI‑compatible images still run unchanged, though operators must switch to containerd or CRI‑O.
The article introduces Nydus, an open‑source container image acceleration solution that replaces the traditional tarball‑based OCI format with a user‑space file system, enabling on‑demand loading, chunk‑level deduplication, secure distribution via Dragonfly, and demonstrates its large‑scale deployment success during Alibaba's 2020 Double‑11 event and in production workloads.
While Docker once dominated containerization, a growing ecosystem of specialized tools—such as Podman, Buildah, Kaniko, BuildKit, and various runtimes—offers more focused, daemon‑less, and OCI‑compatible alternatives for building, running, and distributing images, prompting developers to evaluate which combination best fits their workflows.
Nydus, an open‑source container image acceleration service built on Dragonfly, dramatically reduces image download time, enables on‑demand image loading, provides block‑level deduplication and end‑to‑end data integrity verification, and integrates seamlessly with OCI standards and cloud‑native ecosystems.
The article introduces Nydus, an open‑source container image acceleration service co‑developed by Ant Group and Alibaba Cloud, explaining its architecture, on‑demand download, data deduplication, end‑to‑end consistency, OCI compatibility, and how it speeds up container startup while enhancing security.
The article traces the history from early Live CD technologies like Knoppix’s cloop and SquashFS, through the development of union filesystems such as aufs, to Docker’s layered image model, and discusses emerging next‑generation image formats aiming to reduce redundancy and improve lazy loading.
This article analyzes Docker's declining market share and provides a detailed comparison of alternative container runtimes—including rkt, Mesos, LXC, OpenVZ, and Containerd—highlighting their features, advantages, and limitations for various production scenarios.
This article explains the core concepts of container technology—including specifications, runtimes, management tools, image definitions, registries, and container operating systems—while illustrating why containers are advantageous for developers and operations teams in modern software delivery.
This article explores the evolution and architecture of Kubernetes container runtimes, detailing Docker, containerd, CRI‑O, OCI standards, strong‑isolation solutions like Kata, gVisor and firecracker, and their implications for security and serverless workloads.
In this talk, a former Google SRE shares his experiences moving from massive YouTube growth to Google Cloud operations and later to a Chinese startup, exposing the hidden pitfalls of Docker daemon, image management, container runtimes, and practical DevOps strategies for building, packaging, and running services.
