Docker
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
What is Docker?
Docker is a platform and toolchain for building, distributing and running applications as containers. This profile connects the concept to KBY's practical engineering guidance.
Docker images package an application and its dependencies into layered, immutable artefacts, while containers run those images with operating-system-level isolation. Registries, networks, volumes and Compose support delivery workflows, but production orchestration is usually handled by a separate platform.
Package applications consistently and run them in isolated container environments.
- Packaging applications into containers
- Local development environments
- Continuous integration builds
Explore related technologies
Related technologies
3 resources for Docker
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Learn and operate with Docker
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Systems Engineering(1)
Learn the architecture, concepts and engineering context.
Config Traps(2)
Recognise and avoid known failure modes.
- hostPath readOnly Split Leaves docker.sock WritableA hostPath volume's readOnly flag lives independently from its volumeMount's readOnly flag in Kubernetes, and most admission policies only inspect the volume-level field. A pod can declare a read-only volume while mounting it writable, gaining full write access to /var/run/docker.sock and node root regardless of what the policy audit reports. Open
- hostPath Mounts: The docker.sock Escape HatchA hostPath volume mapping /var/run/docker.sock into a pod grants effective node root regardless of container privilege settings. CI runners and monitoring DaemonSets ship this by default while PSA restricted sits unenforced, letting one compromised build job chroot onto the host, steal the kubelet certificate, and reach cluster-admin-equivalent access across every namespace on that node. Open