Editing Docker (section)

== <span style="color: #FFFFFF;">Understanding</span> ==
Containers work through two Linux kernel features:

* '''Namespaces''' � isolate what a process can see (its own process tree, network interfaces, filesystem, hostname). Each container has its own namespace, so it cannot see or interfere with processes in other containers.
* '''cgroups''' (control groups) � limit and account for resource usage (CPU, memory, disk I/O). A container can be capped at, say, 512MB RAM regardless of what the host has available.

Docker adds a layer of tooling on top: image management, a build system, a networking model, and a runtime (containerd).

When you run a container from an image, Docker creates a thin writable layer on top of the read-only image layers. The image itself is never modified. Multiple containers can run from the same image simultaneously, each with their own writable layer � this is why images are efficient to share and fast to start.

The image layer cache is key to understanding build performance: Docker compares each Dockerfile instruction to its cache. The first changed instruction invalidates the cache for all subsequent instructions. Ordering Dockerfile instructions from least-to-most-frequently-changed minimizes unnecessary rebuilds.
</div>

<div style="background-color: #8B0000; color: #FFFFFF; padding: 20px; border-radius: 8px; margin-bottom: 15px;">