DevOps, SRE & Cloud Interview · Containers & Kubernetes · Lesson 1 of 3
Containers, images & registries
A container packages an app with its dependencies and runs as an isolated process on a shared kernel — using Linux namespaces (isolation) and cgroups (resource limits). It is not a VM: there is no guest OS, so it is far lighter and starts in milliseconds.
- Image = an immutable, layered filesystem + metadata (a template). Container = a running instance of an image.
- Layers are cached and shared: order your Dockerfile so rarely-changing steps (install deps) come before frequently-changing ones (copy source) to maximize cache hits.
- Registry = where images are stored and pulled from (Docker Hub, ECR, GCR, GHCR). Tag by immutable commit SHA, not just 'latest'.
# Multi-stage build: compile in a fat image, ship a tiny one FROM golang:1.26 AS build WORKDIR /src COPY . . RUN go build -o /app ./... FROM gcr.io/distroless/base # minimal runtime, small attack surface COPY --from=build /app /app USER nonroot ENTRYPOINT ["/app"]
Container vs VMA VM virtualizes hardware and runs a full guest OS; a container virtualizes the OS and shares the host kernel. Containers are lighter and faster to start, but share the kernel — so isolation is weaker than a VM's.
◆ Lock it in
- Container = isolated process via namespaces + cgroups; image = its immutable layered template.
- Order Dockerfile steps for layer caching; use multi-stage builds for small, safe images.
- Push to a registry and tag by commit SHA, not just 'latest'.
Feynman drill — say it out loudExplain the difference between an image and a container, and why multi-stage builds produce smaller images.
Step 1 rate your confidence · Step 2 pick your answer
What is the main difference between a container and a virtual machine?
Step 1 — how sure are you?