Understanding Docker Images: Layers, Caching, and Why Size Spirals Out of Control

·1 views

A Docker image is an ordered stack of read-only filesystem layers, where each layer represents a set of filesystem changes relative to the one below it. When a container runs, Docker adds a single thin writable layer on top of these shared read-only layers, enabling multiple containers to launch from one image almost instantly without duplicating data. Instructions like FROM, COPY, ADD, and RUN are the ones that actually create filesystem layers and contribute to image size, while commands like CMD, EXPOSE, and ENV primarily store metadata. Docker's build cache works layer by layer, meaning a single cache miss causes every subsequent instruction to rebuild from scratch — a common cause of unexpectedly slow builds. Understanding this layered model helps developers diagnose bloated images and erratic build times, with tools like 'docker history' offering a quick way to identify which layers are consuming the most space.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

IRSA vs EKS Pod Identity: Choosing the Right AWS Credential Method for Kubernetes

Running applications on Amazon EKS requires pods to securely access AWS services like S3 and DynamoDB without embedding long-lived access keys in Kubernetes Secrets. IRSA, introduced in 2019, uses OpenID Connect federation to issue short-lived credentials by linking Kubernetes ServiceAccounts to IAM roles via a cluster OIDC endpoint. AWS later introduced EKS Pod Identity as a simpler, native alternative that bypasses OIDC entirely, relying instead on a local node agent and a centralized AWS-managed service. While IRSA is production-hardened and broadly compatible, it requires per-cluster OIDC setup and complex trust policies that become difficult to manage at scale. EKS Pod Identity reduces that operational overhead, making credential management more straightforward for teams running multiple clusters or cross-account architectures.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Releases Open-Source Self-Deploying DNS Firewall Appliance for ISPs

A developer has built Sentinel DNS, an open-source DNS firewall appliance designed for ISPs and large corporate networks, built on Rocky Linux and Unbound. The system features unattended Kickstart installation and automatically tunes its own performance based on available hardware, including expanding Linux kernel UDP buffers up to 16MB to handle heavy traffic loads. A standout feature is a real-time 3D Network Operations Center dashboard built with Three.js, which visualises geographic threat arcs connecting local clients to blocked malware sources worldwide. For resilience, the appliance implements RFC 8767, allowing it to serve cached DNS records for up to 24 hours if upstream root servers go offline or face a DDoS attack. The project is publicly available on GitHub and aims to eliminate the manual Linux tuning typically required to deploy high-performance DNS infrastructure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer loses client after GitHub token stolen in supply-chain attack

A developer's GitHub personal access token was stolen, most likely through a supply-chain compromise involving a dependency, editor extension, or Docker image in their local environment. The attacker used the token to push malicious commits to several private repositories, including one belonging to a client. The client terminated the engagement after discovering commits signed under the developer's identity had been compromised. The developer acknowledged the client's decision was reasonable, noting that a stolen token allows attackers to silently push commits, tag releases, and approve deployments while impersonating the victim. Despite working at a cloud-security company and being familiar with similar incidents like the xz-utils backdoor and eslint-scope takeover, the developer admitted their own precautions proved insufficient.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Enterprise MCP Gateways: Why Governance Beats Latency in AI Agent Deployments

Anthropic's Model Context Protocol, released in November 2024, has reached 78% adoption among production AI engineering teams and now has over 9,400 registered servers. As organizations deploy AI agents at scale, each MCP server connection expands the attack surface, enabling agents to read private data and execute commands with little visibility or accountability. MCP gateways have emerged as the industry's answer, acting as a central control plane between AI agents and the tools they access. However, experts caution that most gateways are evaluated on the wrong criteria — latency and integration counts — when the real enterprise value lies in identity federation, audit logging, role-based access control, and policy enforcement. Without these governance capabilities, organizations face compliance exposure and no reliable way to answer auditor questions about agent activity.

0 comments Read more at DEV Community