This repository provides educational material and sample code that demystify how containerization works and how container components fit together in practice. It walks through the responsibilities of an image format, registry, and runtime, and shows how a minimal runtime can assemble an isolated process with the right filesystem view, environment, and entrypoint. The samples highlight security hardening considerations—such as process isolation, filesystem scoping, and least-privilege...