Container Basics

High-level engines

• ★ Docker Engine + Docker Desktop / Compose — still the universal default; especially for dev.
• ★ Podman — daemonless, rootless, drop-in docker CLI compatible. The default for hardened / RHEL-flavored environments.
• nerdctl — docker-shaped CLI on top of containerd; great for low-level work.
• OrbStack — Mac-only; fastest Docker Desktop replacement; commercial license.
• Colima — open-source Docker Desktop alternative on Mac (uses Lima + containerd).
• Rancher Desktop — Mac / Windows / Linux; bundles k3s + nerdctl.

Low-level runtimes

• ★ containerd — what Docker / Kubernetes use under the hood. CNCF graduated.
• ★ runc — the OCI runtime that actually clone()s the container process.
• CRI-O — Kubernetes-native container runtime; Red Hat / OpenShift default.
• gVisor — sandboxed runtime; runs containers in a user-space kernel.
• Kata Containers — VM-isolated containers; stronger isolation than namespaces.
• youki — Rust implementation of runc.

Compose / orchestration on a single host

• ★ Docker Compose — compose.yaml, docker compose up. Default for dev and small servers.
• Podman Compose — Podman's compatible version.
• docker-compose-watch — watch files and restart services.
• Compose Bridge — newer; convert Compose files to k8s manifests.

Useful CLI tools

• ★ dive — interactive image-layer browser; spot bloat.
• ★ lazydocker — TUI dashboard for containers.
• ctop — top-style live container metrics.
• lazyteam / docker-tui — alternative TUIs.
• dockle — image lint / best-practice checker.
• slim (mint) — minify container images automatically.

Image distribution helpers

• Skopeo — copy / inspect / sign images across registries; the swiss-army-knife.
• crane (go-containerregistry) — Skopeo-shape; very fast.
• regctl — modern alternative.

Patterns to know

• Rootless containers — Podman default; Docker supports it but more setup.
• No :latest in production. Pin tags or digests.
• Read-only root filesystem + writable volumes for data; harder to escape.
• tini / dumb-init as PID 1 for any image that doesn't handle SIGTERM correctly.
• Healthchecks in Compose / Dockerfiles so orchestrators know when to restart.
• Build once, promote across envs — don't rebuild for staging vs. prod.
• Set --init when running ad-hoc; reaps zombies, handles signals.
• Compose profiles for "include this only in dev / test / prod."

Networking on a single host

• Bridge network — default; isolated; works for most apps.
• Host network — when you need raw performance or a process to bind to host ports.
• macvlan / ipvlan — for "container looks like a separate device on my LAN."
• Compose service names — DNS-discoverable; use those for inter-container communication.

Pick this if…

• Default everywhere: Docker Engine + Compose for dev, your favorite for prod.
• Hardened / rootless / RHEL ecosystem: Podman.
• Mac dev, want fastest: OrbStack (paid) or Colima (free).
• Kubernetes nodes: containerd + CRI-O (almost never Docker Engine these days).
• Stronger isolation than namespaces: gVisor or Kata.