VRT-210 · Virtualization & Containers · Practitioner
Container Runtimes & the OCI Spec — full syllabus
What runc, containerd and the OCI specifications actually define, and how images become running processes.
Who this course is for
Platform engineers operating container infrastructure — runc, containerd, Kubernetes nodes — who need to know what the OCI specifications actually define and where to look when a container will not start.
Prerequisites
- VRT-201 or equivalent namespace/cgroup knowledge
- Daily container usage (Docker or similar)
- JSON and shell fluency
Course outline
Day 1 — The OCI specifications
- What OCI standardises and what it deliberately does not
- The runtime spec: config.json, the lifecycle states and hooks
- The image spec: manifests, configs, layers and content digests
- runc under the microscope: from spec to running process
- Reading a real runtime configuration and predicting its behaviour
Day 2 — Images and storage
- Image layers as a content-addressed store
- overlayfs: lowerdir, upperdir, work dir and the copy-up path
- Storage drivers and why overlay won
- Pulling, inspecting and diffing an image without Docker
- The true storage cost of a container that writes
Day 3 — containerd, CRI and rootless
- containerd architecture: content store, snapshotters, runtime shims
- CRI and how the kubelet drives containerd
- Rootless containers: user namespace mapping, subuid/subgid and the network limits
- A systematic method for containers that will not start
- Where the Docker/Moby layer fits above all of this
Hands-on labs
- Lab: run a container by hand with runc and a hand-written config.json — no Docker anywhere in the loop
- Lab: dissect an OCI image: pull it with registry tooling, walk the manifest and config, and follow layers by digest
- Lab: reproduce copy-up on overlayfs and measure the storage and latency cost of writes inside a container
- Lab: drive containerd directly with ctr or nerdctl, then trace a Kubernetes pod from the kubelet down to its runc process
- Lab: debug three injected start failures — a bad rootfs, a namespace mapping error, a seccomp rejection — from their actual error paths
Capstone project
Assemble the full stack by hand and then break it: run a workload directly on runc, the same workload through containerd, and the same again as a pod — capturing the configuration and process tree at each layer. The deliverable is a layer-by-layer map of a real container's lifecycle with the exact files and APIs involved, plus a triage record for the three injected failures you diagnosed, written so a colleague could follow it during an incident.
What you leave with
- A precise model of what runc, containerd and the kubelet each do
- Hands-on OCI image inspection skills independent of any one vendor's CLI
- Overlayfs mechanics understood by measurement, not description
- A convergent debugging method for container start failures
- Rootless container configuration you have actually run
Upcoming dates
| Dates | Where | Seats | Early bird | Regular | |
|---|---|---|---|---|---|
| 18 Oct – 20 Oct 20263 full days | RiyadhIn person · KAFD Conference Centre | 9 of 14 | — | SAR 7,880 | |
| 25 Oct – 27 Oct 20263 full days | Kuwait CityIn person · Al Hamra Tower | 4 of 14 | — | KWD 650 | |
| 1 Nov – 3 Nov 20263 full days | MuscatIn person · Knowledge Oasis Muscat | 9 of 14 | — | OMR 810 | |
| 1 Nov – 8 Nov 20266 half-days | Gulf bandLive online · 09:00–13:00 GMT+3 | 15 of 20 | — | US$1,500 | |
| 2 Nov – 4 Nov 20263 full days | OttawaIn person · Kanata North Tech Park | 4 of 14 | — | CAD 2,860 | |
| 9 Nov – 11 Nov 20263 full days | TorontoIn person · MaRS Discovery District | 9 of 14 | CAD 2,570until 10 Oct | ||
| 9 Nov – 16 Nov 20266 half-days | Europe bandLive online · 09:00–13:00 CET | 4 of 20 | US$1,350until 10 Oct | ||
| 16 Nov – 18 Nov 20263 full days | LondonIn person · Shoreditch Works | 4 of 14 | GBP 1,480until 17 Oct | ||
| 16 Nov – 18 Nov 20263 full days | BerlinIn person · Factory Görlitzer Park | 9 of 14 | EUR 1,740until 17 Oct | ||
| 16 Nov – 23 Nov 20266 half-days | Americas bandLive online · 13:00–17:00 ET | 9 of 20 | US$1,350until 17 Oct |
Book a seat, or bring this course to your team
Seats can be reserved online; private delivery runs on-site or live online, adapted to your stack.
Questions about fit or prerequisites? Email hello@kernelsystems.academy. To save this syllabus, print this page to PDF from your browser.