Most engineers who use containers daily cannot say which kernel features make one, why a layer cache missed, what the scheduler scored before it placed a pod, which of six things a pending pod is waiting for, or what happens to running traffic when the control plane dies. Those gaps have costs: an image three times larger than it needs to be, a workload throttled at thirty per cent processor usage because of a limit nobody calculated, a drain that hangs at two in the morning, and an outage spent in the application logs when the datastore had gone read-only an hour earlier.

This course starts below the container. Namespaces and control groups and what each one actually isolates, union filesystems and how a layer cache decides to miss, the image specification and what a registry stores, and the runtime stack from the high-level daemon down to the process that calls into the kernel. Then the build side as it is actually used: build cache ordering, multi-stage builds, base image choices with their real size and patching trade-offs, and container networking and volumes outside an orchestrator.

Kubernetes then gets taken apart rather than toured. The control plane component by component, the interface server's resource model with the datastore behind it, and the reconcile loop as the single pattern everything else is built from. Workloads follow: the pod lifecycle with every phase and condition, the three controllers that manage pods and how they differ, batch workloads and their failure semantics, and probes with the graceful shutdown sequence that decides whether a deployment drops requests.

The middle sections are where production behaviour lives. The scheduler's filter and score phases with the plugins that matter, requests and limits with the quality-of-service classes they produce and the throttling arithmetic behind them, and the three autoscalers with the interactions between them. Then services, the node-level proxy and cluster name resolution, ingress and the newer routing interface, the networking plugin model with network policy, and storage from provisioning through attachment to the failure cases.

The last third is the work of running a cluster. Custom resources and operators, admission webhooks and policy with their availability arithmetic, packaging and overlays with field ownership and server-side apply, authorisation with service accounts and federated workload identity, upgrades with version skew and drains and disruption budgets, and a method for debugging a broken cluster that locates the failure in one of five layers before forming a theory.

Every lesson names the settings it discusses together with their defaults, works the arithmetic with real numbers, and prefers the failure case to the happy path. The test applied throughout is whether a section could have been written without reading the specification, the source or the kernel documentation. If it could, it is not deep enough.

By the end you will be able to explain a container without using the word container, read a pending pod's events and name the cause in seconds, calculate a limit from a measured profile rather than copying one, write a disruption budget that does not stall a drain, decide whether a problem is yours or the platform's, and work through a cluster failure by layer instead of by guesswork.