Conceptual, architectural explainers — how a subsystem actually works underneath.
WSL2's VM claims memory dynamically as Linux needs it and has historically been slow to release it back, plus what .wslconfig actually lets you control.
WSL2's original NAT networking isolates it from your LAN by default; mirrored mode, added later, takes a fundamentally different approach with real tradeoffs.
How admission controllers intercept API requests before they're persisted, and how OPA/Gatekeeper turn that hook into cluster-wide policy enforcement.
How the OCI runtime and image specs standardized what a 'container' actually is, and how containerd/CRI-O/runc fit together beneath Docker and Kubernetes.
How Podman's daemon-less, fork-exec architecture differs from Docker's client-daemon model, and what that means for rootless containers in production.
Why Terraform's state file is the actual source of truth behind every plan and apply, and how drift, locking, and idempotency all follow from that design.
How vulnerability scanners actually inspect container image layers, how to read a scan report, and the practices that reduce real supply-chain risk.
How pod-to-pod networking, Services, and kube-proxy's packet rewriting fit together to make Kubernetes' flat network model actually work.
The two-phase filter-and-score process the Kubernetes scheduler uses to decide which node a pod lands on, and how to influence it.
How multi-stage builds, distroless bases, secret-safe caching, non-root execution, and layer inspection produce smaller, auditable runtime images.