Deep dives into DevOps and Server Side topics where theory blends with hands-on examples. You can try out commands from each tutorial in the attached remote playground, either from the browser or via SSH access from your local terminal — no extra setup required.
Learn how Linux containers are built from the ground up. Starting with the mount namespace and a root filesystem, see why PID, cgroup, UTS, and network namespaces naturally follow - and how this foundation makes concepts like bind mounts, volumes, and persistence in Docker or Kubernetes much easier to grasp.
A practical deep dive into container image internals that will help you build a clear mental model of how images are composed, identified, stored, and distributed across registries.
Learn how to build smaller, more secure Docker container images using Multi-Stage Builds. This guide explains common sources of image bloat, best practices for slimming down production images, and practical examples for Node.js, Go, Rust, and other application stacks. Start optimizing your containers today!
Can a Kubernetes Pod be created with plain Docker commands? Learn the difference between Containers and Pods by exploring how they are implemented under the hood.
Are all containers just Linux processes? How does the OCI runtime specification define a container? What platforms do OCI containers support? What is a Docker container? Linux containers vs. Virtual Machine containers.
When you are new to Docker, the number of commands to study might be truly overwhelming. This tutorial shows a way to internalize the most important Docker commands without the brute-force memorization.
Dive into the internals of the Docker run, attach, and exec commands by following this highly visual and hands-on tutorial.
How to explore the filesystem of a container image using nothing but the standard Docker means (and without running any containers).
Choosing the right base image for your Node.js application can drastically affect its security, size, and performance. This post breaks down popular options - from slim and distroless to full-sized images - helping you navigate the trade-offs and pick the best fit for your development, build, and production needs.
While "FROM scratch" containers may seem functional, they often lack essential components that programs expect to find in their execution environment. Discover the most common pitfalls of building container images "FROM scratch" and learn how to avoid them.
What are these distroless images, really? Why are they needed? What's the difference between a container image built from a distroless base and a container image built from scratch? Let's take a deeper look.
Put OpenClaw, a self-hosted AI assistant with shell and file access, behind a web route and an SSH route, both gated by the same identity and Pomerium's context-aware policy. OpenClaw runs in trusted-proxy mode, trusting signed identity headers instead of its own login, while Pomerium's native SSH proxy signs short-lived certificates for shell access.
Most Kubernetes debugging images ship as a single 200+ MB package. DebugBox takes a different approach: three variants (15 MB, 47 MB, 91 MB) each scoped to a specific debugging task. This tutorial covers when to use lite, balanced, and power, how to run each as an ephemeral container or debug pod, and what tools are available in each variant.
Use Pomerium's native SSH support to publish a local service through a standard reverse SSH tunnel, with OpenID Connect (OIDC) authentication and continuous authorization on every request. Reach services behind Network Address Translation (NAT) without firewall holes or custom agents, and control both who can use the service and who can open the tunnel. Application traffic stays on infrastructure you control.
Pomerium can be used as a native SSH reverse proxy, adding OAuth authentication and flexible Pomerium policy enforcement to standard SSH connections, without the need for tunnels, or custom clients or servers.
In this tutorial, we'll dive into the world of Docker Security, look at the attack surface of a Docker installation and show some straightforward container breakouts
In this brief tutorial we'll explore the idea that Docker containers are just processes, from the perspective of the operating system. Based on this Securitylabs blog post https://securitylabs.datadoghq.com/articles/container-security-fundamentals-part-1/
