Technical Glossary

Isolated user-space process tree bounded by Linux namespaces and cgroups sharing the host kernel.

Immutable read-only tarball bundle containing root filesystem layers, binary dependencies, and OCI runtime metadata.

Linux kernel mechanism metering and limiting hardware resource allocations (CPU, memory, disk I/O) for process groups.

Kernel abstraction restricting what system resources (processes, network interfaces, mounts) a process tree can observe.

Declarative plain-text build manifest consumed by BuildKit to assemble container image layers sequentially.

Storage driver combining distinct read-only image layers and a read-write layer into a single unified directory tree.

Storage optimization strategy deferring file copies until modifications occur, sharing underlying layer blocks.

Concurrent, DAG-based image builder engine in Docker offering parallel step execution and secret mounting.

Dockerfile design pattern using multiple FROM instructions to separate build-time SDK dependencies from slim runtime artifacts.

Open Container Initiative specification defining container image tarball structures, manifests, and layer blobs.

CLI command delegating Dockerfile parsing and layer assembly to the BuildKit engine.

CLI command instantiating and launching a container with specified isolation boundaries, volumes, and ports.

CLI command spawning a new process inside the existing namespaces of a running container.

CLI command creating and starting multi-container services declared in a compose YAML manifest.

HTTP API service storing and serving versioned OCI image manifests and content-addressable layer blobs.