systemd · Kernel Tuning · Namespaces & Cgroups · Profiling · LVM
The exact primitives Kubernetes and Docker are built on top of. Understand namespaces and cgroups here, and "how does a container actually work" stops being magic.
Five layers under the hood — where systemd manages the machine, and namespaces/cgroups quietly became the foundation of every container runtime.
Click any layer to explore concepts, commands, and production-tested guidance.
| Unit Type | Manages |
|---|---|
.service | A long-running process (nginx, sshd) |
.socket | A network/Unix socket, can lazily start its service |
.timer | Scheduled activation — systemd's answer to cron |
.mount | A filesystem mount point |
.target | A synchronization point / group of units (e.g. multi-user.target) |
SystemMaxUse=500M in /etc/systemd/journald.conf — unbounded journals can fill the root disk| Parameter | Effect |
|---|---|
net.core.somaxconn | Max queued connections per listening socket — raise for high-throughput services |
net.ipv4.tcp_tw_reuse | Allows reusing TIME_WAIT sockets for new connections |
net.ipv4.ip_local_port_range | Widens the ephemeral port pool — matters for high-connection-count services |
net.core.rmem_max / wmem_max | Max socket buffer sizes — affects throughput on fast networks |
vm.swappiness (0-100) — lower means the kernel prefers dropping caches over swapping; on DB servers, set low (1-10)vm.overcommit_memory — controls whether the kernel allows allocating more memory than physically exists| Namespace | Isolates |
|---|---|
| PID | Process IDs — a container's PID 1 isn't the host's PID 1 |
| NET | Network interfaces, routing tables, ports |
| MNT | Mount points — a container's filesystem view |
| UTS | Hostname and domain name |
| IPC | Inter-process communication (shared memory, semaphores) |
| USER | User/group ID mapping — root in a container ≠ root on host |
| CGROUP | Cgroup root directory view |
containerd/runc does under Docker/Kubernetes — plus image layers and a lot of tooling| Filesystem | Best For | Notes |
|---|---|---|
| ext4 | General purpose, default on most distros | Mature, predictable, well-understood failure modes |
| XFS | Large files, high-throughput workloads | Default on RHEL; excellent parallel I/O; can't shrink |
| Btrfs | Snapshots, checksums, built-in RAID-like features | More moving parts; used by default on some SUSE/Fedora setups |
A quick lookup for which profiling tool actually answers your question.
| Question | Tool | Why |
|---|---|---|
| "Which syscall is this process stuck on?" | strace | Shows every syscall in real time, including blocking ones |
| "Which function is burning CPU?" | perf | Sampling profiler, low overhead, gives you a flame graph |
| "Is this a CPU, memory, or disk problem?" | vmstat / iostat | Fastest first-pass triage before reaching for heavier tools |
| "Is the network the bottleneck?" | sar -n DEV | Per-interface throughput over time |