DevOps8 min read
Containers, without the magic
If you've only ever used `docker compose up`, the abstraction does its job too well. Building Inception — which forbids Compose — was the moment containers stopped being magic and started being mechanism.
What `docker run` is actually doing
A container is not a tiny VM. It's a regular Linux process, wrapped in namespaces (which limit what it can see) and cgroups (which limit what it can use). When you understand that, the rest of the system stops feeling mysterious.
Inception asked me to set up NGINX, WordPress, and MariaDB as three separate containers, on a custom network, with TLS, persistent volumes, and no shortcuts. Each Dockerfile had to be hand-written. No `mysql:8` from Docker Hub.
The volume problem
Volumes are the part that breaks people. The mental model that worked for me: a volume is a directory on the host that gets mounted into the container's filesystem. That's it. The container thinks it owns the path; the host knows better.
volumes:
- /home/user/data/wordpress:/var/www/html
- /home/user/data/mariadb:/var/lib/mysqlIf your container writes to a path that isn't a volume, that data dies with the container. This is by design and it is the entire point.
TLS in twelve lines
Configuring NGINX for TLS-only with a self-signed cert is genuinely about a dozen lines. The hard part isn't the config — it's making peace with the fact that you, alone, are now responsible for a private key.
Tools you can't take apart will eventually own you.