The Netflix of Infrastructure: We Build Everything From Scratch.
No toy hello-worlds. We start from a blank terminal, demystify the Linux Kernel, write production Dockerfiles, and solve real 2 AM outage post-mortems.
Why Every Developer Must Learn Real Infrastructure in 2026
Building features is easy. Making them survive 50,000 concurrent users, sudden failovers, and container crashes is what separates juniors from staff engineers.
The "It Works on My Machine" Curse
The Production Pain: Apps run fine locally on macOS/Windows, then crash in production due to Linux dependency mismatches, missing glibc libraries, or unhandled file permissions.
The Silent 2 AM OOMKilled Disasters
The Production Pain: Node.js, Python, and Java processes consume memory beyond container Cgroup limits, causing the Linux kernel to send SIGKILL (Exit code 137) with zero logs.
Bloated 1.5GB Images & Exploding Bills
The Production Pain: Copying entire node_modules or build toolchains into production images creates 10-minute CI/CD deploys and massive cloud registry bandwidth costs.
Running Containers as Root in Production
The Production Pain: Over 70% of public Dockerfiles run as the root user with full host access, allowing container escapes to compromise the entire host infrastructure.
We Build Everything From Scratch. No Magic Black Boxes.
Most tutorials hand you a finished configuration file and tell you to run it. At **Infra & You**, we start with a blank terminal. We dissect the Linux system calls, build the container layers, wire up the networking bridges, and deliberately crash systems to show you how to rescue them under fire.
Interactive Theory, Diagrams & Live Docker Sandbox
Inspect visual architecture diagrams, edit the Dockerfile, and run real commands in the terminal with live web container preview.
Lab 1: Container Isolation & Port Forwarding
Containers are NOT mini-virtual machines. A container is simply a standard Linux process running with restricted visibility enforced by the Linux Kernel through 6 Namespaces and Cgroups.
Core Concepts to Understand:
Gives the container its own isolated process tree where your app runs as PID 1, while on the host system it has a regular high PID (e.g. PID 48192).
Creates a virtual ethernet interface (veth) connected to the docker0 bridge. Port forwarding configures iptables NAT rules on the host.
Gives the container its own private root filesystem (/) layered over the host storage without modifying host files.
Linux Kernel Container Isolation Architecture
How Host Kernel isolates PID, Network & Mounts without a Hypervisor
💡 Interactive Concept: Click on any container above to inspect how Linux isolation primitives work under the hood.
The AI Infrastructure Stack:
Agent Gateway&Kagent SRE
Calling LLM APIs in development is trivial. Running hundreds of autonomous agents in production with zero 429 rate limit outages, 80% token cost reduction, Anthropic MCP sandboxing, and Kubernetes self-healing is where real engineering begins.
Agent Gateway: Unifying Claude 3.7, DeepSeek-R1, and Anthropic MCP
apiVersion: gateway.ai.infra/v1
kind: AgentRoute
metadata:
name: claude-deepseek-arbitrage
spec:
routing:
primary: anthropic/claude-3-7-sonnet
fallbacks:
- aws-bedrock/claude-3-7
- deepseek/deepseek-r1
- openai/gpt-4o
failoverOn: [429, 502, 503, timeout]
caching:
semanticSimilarity: 0.92
vectorDb: pgvector.internal:5432
ttl: 7200s
mcp:
sandbox: gVisor
allowedTools: [sql_exec, github_pr]Why Traditional Web Infrastructure Breaks Under AI Agent Workloads
Agents generate unpredictable streaming sessions, multi-turn tool loops, and massive GPU token costs that standard load balancers were never designed for.
| Feature / Requirement | Traditional Web Infra (NGINX / ALB) | Modern AI Infra (Agent Gateway + Kagent) |
|---|---|---|
| Rate Limits & Outages | Drops requests with HTTP 429 & fails end user. | Sub-millisecond dynamic arbitrage across Anthropic, Bedrock, and DeepSeek. |
| Caching Strategy | Exact string match only (0% hit rate for LLMs). | Vector semantic caching with pgvector (80%+ cost savings). |
| Tool Calling & Sandbox | Blind proxy; no understanding of agent tools or MCP. | gVisor microVM isolation + eBPF kernel audit for every SQL/Bash call. |
| Incident Diagnostics | Pagers wake up humans at 3:00 AM to read raw logs. | Kagent SRE operator auto-triages CrashLoops, patches manifests, and writes PRs. |
The Netflix of Infrastructure: Built from Scratch
Every season is an end-to-end journey starting from bare-metal primitives and building up to massive distributed systems. No skipped steps. No magic black boxes.
Docker & Containers from Absolute Scratch
From Linux cgroups and namespaces to 18MB Distroless images and multi-container Compose fleets.
Kubernetes Platform from Scratch
Control plane internals, custom controllers, etcd Raft consensus, and multi-cluster networking.
Terraform & Infrastructure as Code from Scratch
State locking, custom providers, immutable infrastructure, and multi-cloud production architecture.
ArgoCD & GitOps Progressive Delivery from Scratch
Declarative cluster states, automated drift reconciliation, canary rollouts, and multi-cluster GitOps.
Crossplane & Universal Cloud Control Planes
Turn Kubernetes into a universal control plane to provision cloud databases, networks, and IAM.
Docker & Containers from Absolute Scratch
We do not start with Docker Desktop. We start with raw Linux primitives (unshare, chroot, cgroups v2), build a working container engine in pure bash, and then graduate to production-grade Dockerfile optimization, multi-stage caching, and zero-downtime Compose stacks.