Blog
Engineering notes on Kubernetes, containers, networking and DevOps.
-
The Kubernetes Scheduler: How a Pod Picks a Node
The scheduler looks like magic - you create a Pod and it lands somewhere sensible. Under the hood it is a filter-then-score pipeline: hard constraints first, then a competition of soft preferences. Build it from first principles.
-
The Linux Network Stack, One Packet at a Time
What actually happens between your process calling send() and bytes leaving the wire. The ring buffer, softirqs, sockets and the queue of queues - the journey of one packet through the Linux network stack.
-
eBPF for Beginners: How to Run Code Inside the Linux Kernel
What eBPF actually is, how a program gets from your source file into the kernel, and why it quietly became the engine behind Cilium, Falco and modern observability. Explained from first principles, with simple diagrams.
-
cgroups: How Linux Limits Resource Usage
cgroups are the quiet machinery that turns a shared Linux box into thousands of isolated containers. How CPU shares, memory limits and the OOM killer actually work, from first principles.
-
NAT, Demystified: From Your Home Router to Docker and Kubernetes
One idea - rewriting addresses in flight - quietly powers home-router sharing, Docker's common bridge setup, and Kubernetes Service routing in kube-proxy's iptables mode. This is NAT from first principles up to kube-proxy.
-
How CSI Drivers Actually Work in Kubernetes
A ground-up deep dive into the Container Storage Interface - the gRPC contract, the controller/node split, the full provision-attach-mount lifecycle, and how it all maps onto Azure Disk in a real cluster.
-
CRI-O: The Container Runtime Built for Kubernetes - A Complete History and Technical Deep Dive
From the CRI specification to dockershim removal to production default - the complete story of CRI-O, its architecture, its relationship to OCI and runc, how it differs from containerd, and why it matters.
-
Security Contexts in Kubernetes: From Process Isolation to Defense in Depth
An exhaustive examination of security contexts - every field explained, how they interact with Linux kernel security mechanisms, their place in the broader Kubernetes security stack, and patterns for production hardening.
-
Liveness, Readiness, and Startup Probes: The Complete Guide
How Kubernetes knows if a container is actually working - the history of probes, how each handler type works under the hood, the timing mechanics every operator should know, and production patterns for reliability.
-
Why Istio? kube-proxy Handles Routing - Or Does It?
A detailed examination of what kube-proxy actually does versus what a service mesh adds, the architectural differences, and a decision framework for when each makes sense.
Browse the Archive for the full list.