JSTAcademy
0 XP
Dashboard
Networks & OS
Virtualization & Containers Deep Dive
16 min
PhD+175 XP
Networks & OS · PhD

Virtualization & Containers Deep Dive

Hypervisors, namespaces, cgroups, Kubernetes scheduling — how isolation works
16 min read+175 XP on completionCert: Networks & Operating Systems
Tap any word in the text below to start reading from there.

Virtualization & Containers Deep Dive

Virtual Machines and Hypervisors

Hardware-assisted virtualization (Intel VT-x, AMD-V): the hypervisor runs in VMX root mode; guest VMs in VMX non-root mode. Privileged instructions cause VM exits — the hypervisor handles them and resumes the guest.

Type 1 (bare-metal): KVM, VMware ESXi, Hyper-V — runs on hardware directly; used in cloud data centers. Type 2 (hosted): VirtualBox, VMware Workstation — runs on a host OS; used for local dev.

KVM: a Linux kernel module turning Linux itself into a Type 1 hypervisor. Used under AWS EC2, GCP, Azure.

Linux Namespaces

Containers are not VMs — they share the host kernel but use namespaces to isolate resource views:

  • PID: container processes can't see host processes
  • NET: container gets its own network interfaces and routing table
  • MNT: container has its own filesystem view
  • USER: UID 0 inside the container maps to an unprivileged user outside (user namespace remapping)

NET namespace: each container gets a veth pair. One end in container namespace, other on docker0 bridge on host. Bridge provides inter-container communication and NAT to the outside.

cgroups

CPU: cpu.shares (relative weight) or cpu.cfs_quota_us (hard cap). --cpus=0.5 = at most 50% of one core.

Memory: memory.limit_in_bytes — exceeded → OOM killer terminates a process in the cgroup.

cgroup v2: unified hierarchy; default in modern Linux distros.

Docker Image Internals

overlayfs merges layers: container's writable upper layer sits on top of read-only image layers. Reads go top-down. Writes go to upper layer only. 100 containers from the same image share image bytes on disk.

Multi-stage builds: build in a full image (compilers, tools), copy only compiled artifacts into a minimal production image. Build toolchain is not in the final image.

Kubernetes Scheduling

  1. Filtering: remove nodes that don't satisfy resource requests, nodeAffinity, taints/tolerations
  2. Scoring: rank by LeastRequested (spread workload), BalancedResourceAllocation, InterPodAffinity
  3. Binding: write nodeName to Pod spec

Requests vs Limits: requests are what the scheduler reserves; limits are the cgroup ceiling. OOM kill on memory limit exceedance; CPU throttling on CPU limit exceedance.

QoS classes: Guaranteed (requests = limits, last evicted), Burstable (requests < limits), BestEffort (no requests/limits, first evicted).

Container security: run as non-root (USER nonroot in Dockerfile), avoid --privileged, use seccomp profiles to whitelist syscalls, AppArmor/SELinux for MAC.

0%