Recipes and Runtimes: Making Sense of Containers in 2026
summary
Builds a simple Node + Express app and shows how a naive Ubuntu-based Docker image balloons to ~1.79 GB, then drops to ~330 MB with a multi-stage Node 24 slim build and further to 44.2 MB final image using Rockcraft plus Chisel slices; demonstrates packing an OCI .rock, running it via Docker (Skopeo import), and Pebble as the process manager. Covers rootless runtimes (Podman), image signing, provenance, SBOMs and SLSA. Rockcraft + Chisel + Pebble
AI-written summary · about
chapters (20)
- 0:00Containers workshop intro
- 3:10History of containerization
- 6:28Microbakery analogy
- 10:36Dockerfile for Node.js
- 14:11Bloat and insecurity in Docker
- 15:35Image hardening basics
- 17:45Multi-stage builds
- 19:34Minimal base images
- 22:46Rockcraft and Chisel intro
- 25:14Rockcraft YAML
- 33:27Rockcraft images with Docker
- 36:54Root user risks
- 38:19Chisel slices
- 43:32Custom Chisel slices
- 46:27Chisel results
- 48:35Supply chain attacks
- 50:23Rootless runtimes
- 51:47Image signing
- 53:13SBOM and SLSA
- 54:19Summary
related talks
14mSmall Containers? or Small Images?
29mDockerfile: the best practices
40m"Willy Wonka and the Secure Container Factory"
01h 00mDocker, FROM scratch
01h 01m.NET and Containers - each layer of abstraction indistinguishable from magic
16mSimplifying the Journey of Your Containerized Application from Dev to Production
20mCreating Production Ready Containers: What Devs Need to Know to Secure Their Containers
35mOptimizing Containers for Security and Scaling