9.2. Container Internals & Kubernetes in Production
A container is not a lightweight VM; it is a normal Linux process wrapped in namespaces and cgroups that constrain what it can see and consume. Knowing exactly what those primitives do is the difference between guessing at an OOMKill and understanding it. This chapter descends below the Kubernetes abstractions into container internals, the resource-management model (requests, limits, QoS, CPU throttling) that decides who gets killed under pressure, cluster networking, persistent storage, graceful termination, and the autoscaling that sizes the cluster itself.
Topics Covered
Section titled “Topics Covered”- 9.2.1. Container Internals: Namespaces, cgroups v2, and the OCI Runtime: Descends into namespaces, cgroups v2, and the OCI runtime that make a container a constrained Linux process.
- 9.2.2. Resource Management: Requests, Limits, QoS, OOMKill, and CPU Throttling: Covers requests, limits, QoS classes, OOMKill, and the CFS quota throttling that surprises everyone.
- 9.2.3. Kubernetes Networking: Services, kube-proxy, and CNI: Explains the Service abstraction, kube-proxy’s mechanics, and the CNI that wires pod networking.
- 9.2.4. Persistent Storage: PV, PVC, and the CSI Interface: Covers persistent volumes, claims, and the CSI interface that connects clusters to storage backends.
- 9.2.5. Graceful Termination and PodDisruptionBudgets: Explains the SIGTERM-to-SIGKILL shutdown sequence and PodDisruptionBudgets that protect availability during drains.
- 9.2.6. Cluster Autoscaling: Cluster Autoscaler, Karpenter, and VPA: Compares Cluster Autoscaler, Karpenter, and VPA for sizing the cluster and its pods to actual demand.