From d8a39c6a6c508c8eb65f2d67e7fca40ab1385fad Mon Sep 17 00:00:00 2001 From: jwright Date: Mon, 17 Aug 2026 16:11:22 +1000 Subject: [PATCH] footer trimmed to the credit line; podman and oc throughout (Containerfile, podman docs links) --- pilot/arc.tpl.html | 32 +++++++++++++++----------------- pilot/manifest-orbit.json | 2 +- 2 files changed, 16 insertions(+), 18 deletions(-) diff --git a/pilot/arc.tpl.html b/pilot/arc.tpl.html index cd9efe6..0bae5e5 100644 --- a/pilot/arc.tpl.html +++ b/pilot/arc.tpl.html @@ -11,7 +11,7 @@

Index

  1. Course 00Aperitif - three commands, and what actually just happened
    2. -
  2. Course IDocker - an image is a stack of frozen diffs
    3. +
  3. Course IPodman - an image is a stack of frozen diffs
  4. Course IIKubernetes - a cluster is a promise, not a place
  5. Course IIIThe node - where intent becomes a process
  6. Course IIIThe pod - one IP, shared fate
    7. @@ -52,15 +52,15 @@ Six dark armour fragments with neon seams framing a large empty centre - the casing of a machine caught the instant before it comes apart. - @@ -78,7 +78,7 @@
    -

    Course I · Docker

    +

    Course I · Podman

    An image is not a box.
    It is a stack of frozen diffs.

    Scroll, and the thing you keep calling "a container image" comes apart in your hands. Four layers. Each one only stores what changed from the layer under it - and here they @@ -108,17 +108,17 @@

    The builder caches layer by layer, and a cached layer survives only while everything beneath it is unchanged. Put COPY . . above your dependency install and you have told the builder to throw the dependency cache away every time one - line of code changes. Dependencies first, code last - a Dockerfile is a cache policy that + line of code changes. Dependencies first, code last - a Containerfile is a cache policy that happens to build software.

    Field note. A rebuild that takes twenty minutes and one that - takes twenty seconds are usually the same Dockerfile with the lines swapped.

    + takes twenty seconds are usually the same Containerfile with the lines swapped.

    This stack explains the whole ecosystem above it: sharing explains why pulls are fast, immutability explains why a digest can name the exact bytes (Course VII), and the throwaway top layer explains why state needs volumes. One idea - frozen diffs - all the way down.

    Pre-reads: none - start here -  Further: Docker get-started · - Docker build + layers

    +  Further: Podman get-started · + Podman docs + builds

    @@ -146,7 +146,7 @@

    Desired against actual, forever

    The habit underneath everything: the reconciliation loop - compare desired state - against actual state, fix the difference, repeat. That kubectl apply + against actual state, fix the difference, repeat. That oc apply didn't launch anything; it filed paperwork. The machine took it from there, and it never stops taking it from there: kill a pod and it returns, not because something noticed the crash but because the loop noticed the difference.

    @@ -340,7 +340,7 @@

    Nobody deploys anything.
    The cluster syncs itself.

    The mental model everyone arrives with: someone with credentials pushes manifests at the cluster. In GitOps nothing is pushed. A repository holds the desired state, an agent - inside the cluster watches it, and the cluster pulls its own future from git. kubectl is for + inside the cluster watches it, and the cluster pulls its own future from git. oc is for looking; git is for changing.

    @@ -362,7 +362,7 @@ revision - watch this branch of this repository - and the controller renders what it finds there, compares it against the live cluster, and syncs the difference. The deploy button is a git commit; the audit log is git log; code review is change control.

    -

    kubectl apply is for archaeology, not for change.

    +

    oc apply is for archaeology, not for change.

    Pull, not push - the security inversion

    The cluster pulls. No CI system, no laptop, no build pipeline holds a credential that can touch it - the agent inside holds a read-only deploy key, and the trust arrow points out. @@ -645,8 +645,6 @@

    diff --git a/pilot/manifest-orbit.json b/pilot/manifest-orbit.json index 733c362..e60e608 100644 --- a/pilot/manifest-orbit.json +++ b/pilot/manifest-orbit.json @@ -457,7 +457,7 @@ { "name": "console", "title": "oc + console", - "blurb": "kubectl, extended - the operator's handheld.", + "blurb": "The CLI and the web console - the operator's handheld.", "z": 0, "points": [ [