Rocket & the App Container Spec
summary
Rocket (rkt) targets Linux with daemon-free foreground execution, converts Docker images on the fly into ACI archives, and composes multi-ACI pods that share namespaces and mounts. Images become content-addressed by SHA-512 and ship with detached GPG signatures that executors verify via simple HTTP or meta discovery (S3, buckets, templates). rkt hands off processes to the OS using systemd unit integration, supports pluggable backends (including Intel clear VMs that boot in ~150 ms), and enforces GC and explicit trust for reproducible runs.
AI-written summary · about
chapters (24)
- 0:00Intro
- 4:42App Container Spec
- 6:40Image Format
- 10:22Discovery Mechanism
- 13:09Runtime Environment
- 15:30AC Tool
- 16:59Docker to CI Tool
- 18:19Multiple Implementations
- 20:46What is a CLI
- 23:48Intel Containers
- 25:15How Rocket Works
- 26:04Container Hashes
- 27:37Running a Pod
- 29:01Garbage Collection
- 30:15SystemD Upstart
- 31:15Docker Conversion
- 33:21Docker to CI
- 35:29Patch Command
- 36:21Docker Manifest
- 39:05Creating SystemD
- 40:04Starting SystemD
- 40:44Rocket List
- 41:09Machine CTL
- 41:55Questions
related talks
05mIntroduction to rkt
23mrkt Intro
36mrkt Deep Dive
51mContainers' Jungle. Docker, Rocket, RunC, LXD ... WTF?
34mWhat Container Runtime Engine Do I Need?
25mFrom Cloud To AI: How Kata Containers 4.0 Reinvents the Sandbox for the Agent Era
37mCRI-O: Under the Hood
55mRecipes and Runtimes: Making Sense of Containers in 2026