MODULE 1  ·  DAY 1

Container-Native GenAI

Why the open standard — not Docker — is the through-line for AI

AI Colima Rancher OrbStack Podman

Gourav Shah  ·  School of DevOps & AI  ·  Lesson + Lab + Quiz

M1·01

What you'll learn

Five ideas that shape every lab in the rest of the course.

12 34 5 Why "container-native" beats "Docker-native" — OCI + the Compose Spec What containers actually buy an AI stack: package, serve, isolate, ship The Apple-Silicon GPU limit and the native-server / containerized-app fix The OpenAI-compatible endpoint as one universal, swappable contract The 2026 map: declarative agents vs orchestration, and the Acme ladder

Concepts first — the lab then proves the container-to-native-model wiring with your own hands.

M1·02

The assumption that just broke

Docker Desktop is now paid for orgs over 250 staff or $10M revenue. "Container = Docker" no longer holds.

the old assumption container = Docker Desktop a pricing change, not a technical one what still holds container = the open OCI standard

The standard under Docker was always open. This module builds on that standard, not on any one vendor.

M1·03

Container-native, not Docker-native

An OCI image is a shipping container — the same steel box loads onto any carrier. Docker is just one carrier.

compose.yaml open Compose Spec Colima OrbStack Rancher Desktop Podman Desktop Same app identical containers

One file, four runtimes, same result — the carrier you pick is your business, not the course's.

M1·04

What containers buy an AI stack

Think of each component as a hermetically sealed shipment you can open on any machine.

Package Pin Python, CUDA, library versions — "works everywhere" Serve Embed, vector DB, API behind fixed ports, no pollution Isolate Conflicting deps? Each framework in its own sealed box Ship Push to any OCI registry, pull anywhere

Package, serve, isolate, ship — the four jobs a container does for every piece of your AI stack.

M1·05

The Apple-Silicon GPU reality

macOS containers are like guest rooms with no power outlets — the building has power, the rooms aren't wired in.

The building (your Mac) Mains power = Metal GPU + unified memory Guest rooms = containers no outlet on the wall — they fall back to battery (CPU) Hypervisor.framework exposes no virtual GPU Model inside a container runs 3–6× slower on CPU

The single most important practical lesson: get this wrong and every lab crawls. So don't fight it — wire around it.

M1·06

The fix: native server, containerized everything else

Serve the model natively on Metal; put the app, agent and vector DB in containers; bridge them with one magic hostname.

macOS host (Apple Silicon) Ollama — NATIVE Metal-accelerated unified memory listens on :11434 Container runtime App (Streamlit) Agent (crew) Vector DB (ChromaDB) http://host.docker.internal :11434

On Windows + WSL2 + NVIDIA the toolkit passes the GPU in, so the server can be containerized there.

M1·07

One universal contract: the OpenAI-compatible endpoint

The API is a wall socket. Swap the power station behind it and your appliance never notices.

Ollama vLLM llama.cpp /v1/chat/completions Your app / agent code never changes

The same request runs against Ollama on a laptop, vLLM on a GPU VM, or OpenAI — every lab speaks this language.

M1·08

The 2026 map: declarative vs orchestration

Two ways to build an agent. Start with the light one; reach for the heavy one only when you must.

Declarative agents (M6) Who the agent is + what tools it has, written in plain files The runtime executes them Change a markdown file → change the behaviour Orchestration (M7) LangGraph — deterministic control flow explicit state machines, branching Retries, human-in-the-loop checkpoints For hard sequencing a declarative agent can't self-determine add only when needed

The rule: start declarative; add orchestration only when the task has hard sequencing you can't express in tools.

M1·09

Anatomy of a declarative agent

Four plain parts define an agent — no framework code required to describe who it is.

A declarative agent AGENTS.md / SOUL.md who the agent is — role & intent SKILL.md reusable capabilities it can call MCP tool connections what it can reach in the world Guardrails limits on what it may do

Identity, skills, tools, guardrails — all in files you can read, diff, and version like any other code.

M1·10

Meet Acme — two connected tools

One fictional company, runbooks nobody reads, and two AI tools that fix it across the two days.

Acme's runbooks DAY 1 · GenAI Docs Assistant Naive RAG: question → docs → answer used as a tool DAY 2 · Agentic Support Agent → Incident Crew single → multi-agent

Use Case B uses Use Case A as one of its tools — skills compound instead of tangling.

M1·11

The build ladder — one step per module

Every module adds exactly one rung to the same growing compose.yaml.

M1 model M2 serve M3 scale M4 package M5 RAG M6 agent M7 crew M8 · Ship + Capstone ← DAY 1 · Serve & Package DAY 2 · RAG → Agentic → Ship →

Module 1 is step 0: a runtime and a model responding to a call. You hand-author every block from here.

M1·12

TO THE LAB

Build it once. Run it anywhere.

throwaway container host.docker.internal:11434 a real response back Ollama native · Metal GPU

In the lab you'll prove this wiring yourself — container calls native model, and it answers.

Now open Module 1 · Lab.  ·  Gourav Shah · School of DevOps & AI

M1·13