Containers

CNCF Cloud-Native Definition & Principles

The CNCF’s formal definition of cloud-native computing and core principles for micro-services, containers, and dynamic orchestration.

Kubernetes Pod Security Standards

Baseline, restricted, and privileged policy levels for securing pod workloads.

CNCF Cloud-Native Security Whitepaper

Guidance on building, shipping, and running secure cloud-native applications.

Helm Chart Best Practices

Recommendations for structure, naming, versioning, and values of Helm charts.

Container Image Hardening Guide

Steps to build minimal, non-root, signed container images with SBOMs.

Sidecar Pattern

A design pattern that deploys a helper component alongside the main application in the same unit, adding capabilities like proxying, logging, or config without changing the app.

Anti-Patterns3

Anti-Pattern

Works on My Machine

Code that runs only in a developer's local setup because of undeclared dependencies and environment assumptions, then fails everywhere else.

Anti-Pattern

Environment Parity Gap

Development, staging, and production environments differ enough that testing in one gives little confidence about behavior in another.

Anti-Pattern

Latest Tag in Production

Deploying container images by the mutable :latest tag, so production runs an unknown, changing version that cannot be reliably reproduced or rolled back.

Tutorials22

Local Development with Docker Compose

Set up a complete development environment with Docker Compose

How to build and optimize Docker images for smaller, faster builds

Reduce Docker image size and build time with layer ordering, .dockerignore, and build cache strategies.

How to use multi-stage Docker builds to shrink production images

Separate build and runtime stages so compilers and dev dependencies stay out of the final image.

How to build distroless container images for minimal attack surface

Run applications on distroless base images that contain no shell or package manager, reducing size and CVEs.

How to run a multi-container app with Docker Compose

Define an app, a database, and a cache as services in one Compose file with networks, volumes, and health checks.

How to deploy an application to Kubernetes with Deployment and Service

Package an image into a Kubernetes Deployment and expose it with a Service, then scale and roll out updates.

How to package a Kubernetes app with a Helm chart

Create a reusable Helm chart with templated manifests and values so one app deploys cleanly across environments.

How to configure liveness, readiness, and startup probes in Kubernetes

Add health probes so Kubernetes restarts unhealthy pods and only routes traffic to ready ones.

How to autoscale pods with the Kubernetes HorizontalPodAutoscaler

Scale a Deployment automatically on CPU or custom metrics using the HorizontalPodAutoscaler and metrics-server.

How to expose Kubernetes services with an Ingress and TLS

Route external HTTP traffic to services using an Ingress controller, host and path rules, and automatic TLS.

How to manage configuration with Kubernetes ConfigMaps and Secrets

Externalize app settings into ConfigMaps and sensitive values into Secrets, mounted as env vars or files.

How to run stateful workloads with a Kubernetes StatefulSet

Deploy databases and other stateful apps with stable network identities and per-pod persistent storage.

How to set up RBAC in Kubernetes with Roles and ServiceAccounts

Grant least-privilege access to users and workloads using Roles, RoleBindings, and ServiceAccounts.

How to restrict pod traffic with Kubernetes NetworkPolicies

Lock down pod-to-pod traffic with default-deny and selective allow rules using NetworkPolicy resources.

How to enforce Pod Security Standards in Kubernetes

Apply the built-in Pod Security Admission to enforce baseline and restricted policies per namespace.

How to build and run rootless containers

Run containers as a non-root user with Podman or Docker rootless mode to reduce privilege and risk.

How to set Kubernetes resource requests and limits correctly

Right-size CPU and memory requests and limits to improve scheduling, stability, and Quality of Service.

How to deploy a container to Google Cloud Run

Containerize an app and deploy it to Google Cloud Run for autoscaling, request-billed serverless hosting.

How to do blue-green deployments on AWS with CodeDeploy

Run zero-downtime blue-green deployments for containers on Amazon ECS using AWS CodeDeploy and a load balancer.

How to deploy a serverless container with Azure Container Apps

Deploy a containerized service to Azure Container Apps with scale-to-zero, ingress, and revision-based updates.

How to publish a Docker image to a registry from CI

Build a Docker image in CI and push it to a container registry with proper tags and authentication.

How to sign container images with Cosign

Sign and verify container images with Cosign keyless signing to secure your software supply chain.

Blueprints11

Physical Servers to Kubernetes Blueprint

Modernize applications running on bare-metal physical servers into containers orchestrated by Kubernetes, with phased discovery and re-platforming.

Lift-and-Shift to Re-Platform Blueprint

Take rehosted cloud workloads from a lift-and-shift phase and progressively re-platform them onto managed and serverless services for better cost and operations.

Monolithic VM Application to Containers Blueprint

Containerize a large monolithic application running on virtual machines, externalizing state and config to run reliably on a container platform.

Self-Managed Kubernetes to Amazon EKS Blueprint

Migrate a self-managed (kubeadm) Kubernetes cluster to Amazon EKS, offloading control-plane operations while preserving workloads and GitOps.

Self-Managed Kubernetes to Google GKE Blueprint

Migrate a self-managed Kubernetes cluster to Google Kubernetes Engine, optionally Autopilot, to offload node and control-plane operations.

Cloud Foundry to Kubernetes Blueprint

Migrate applications from a Cloud Foundry PaaS to Kubernetes, converting buildpacks and manifests into container images and declarative deployments.

Docker Swarm to Amazon ECS Blueprint

Migrate containerized services from Docker Swarm to Amazon ECS on Fargate, translating Compose-style stacks into task definitions and services.

On-Prem VMs to GKE with Migrate to Containers Blueprint

Modernize on-premises VMs directly into containers on Google GKE using Migrate to Containers, skipping a separate VM rehosting step.

Java EE on WebSphere to Spring Boot Blueprint

Migrate Java EE applications off WebSphere onto Spring Boot with embedded servers, externalized config, and container-native packaging.

.NET Framework to .NET 8 Modernization Blueprint

Migrate legacy .NET Framework applications to cross-platform .NET 8 with the SDK project format, modern hosting, and EF Core.

VM-Deployed App to Cloud-Native Blueprint

Re-platform a VM-deployed backend application to a cloud-native architecture with containers, managed services, and twelve-factor config.

Migrations7

AWS EC2 to ECS Fargate Migration

Move containerized services from EC2-managed hosts to ECS Fargate for serverless containers

AWS ECS to EKS Migration

Migrate container workloads from ECS to Kubernetes (EKS) with deployment and networking redesign

Docker Compose to ECS Fargate Migration

Migrate local Docker Compose definitions to ECS Fargate tasks and services

Docker Compose to Kubernetes Migration

Containerized application migration from Docker Compose to Kubernetes

Docker Swarm to Kubernetes Migration

Migrate Swarm services to Kubernetes deployments, services, ingress, and config/secrets

Heroku to GCP Cloud Run Migration

Migrate Heroku apps to Cloud Run with containerization, config, and managed services mapping

VMs to Kubernetes Migration

Containerize and migrate VM-hosted apps to Kubernetes with health checks, scaling, and deployment automation

Integrations1

Integration

Docker Hub / Container Registries

Registry-triggered CycloneDX SBOM generation feeding the existing SBOM importer — not a scan-and-migrate tool.

Reference Architectures7

EKS Production Container Platform

A hardened, multi-account Amazon EKS platform for running production microservices with GitOps delivery and full observability.

Serverless API on GCP Cloud Run

A container-based serverless API on Google Cloud Run with Cloud SQL and Pub/Sub, scaling to zero while keeping standard container portability.

Container Platform with Service Mesh

A Kubernetes container platform with an Istio service mesh providing mTLS, traffic management, and uniform observability across services.

GKE Autopilot Application Platform

A managed GKE Autopilot platform on GCP that runs containers without node operations, with workload identity and integrated observability.

AKS Enterprise Container Platform

An enterprise Azure Kubernetes Service platform with private networking, Entra ID identity, and policy-governed GitOps delivery.

ECS Fargate Microservices Platform

A serverless container microservices platform on AWS ECS Fargate with service discovery, autoscaling, and no servers to manage.

Batch Jobs Platform on Kubernetes

A Kubernetes-native batch platform using job queues and Argo Workflows to run scheduled and on-demand container jobs at scale.

Playbooks9

Kubernetes Platform Adoption Playbook

A phased program to stand up a production-grade internal Kubernetes platform and onboard application teams onto golden paths.

Container Platform Migration Playbook

A phased program to migrate workloads from VMs and Docker Compose onto a managed container platform with standardized build and deploy.

Java EE to Spring Boot Program Playbook

An enterprise program for migrating Java EE applications to Spring Boot with modern build, runtime, and deployment practices.

.NET Framework to .NET Modernization Program Playbook

A portfolio program for moving .NET Framework applications to modern cross-platform .NET with containerized, cloud-ready deployment.

Node.js Major-Version Upgrade Program Playbook

A fleet-wide program for upgrading Node.js services across major runtime versions with dependency and ESM modernization.

Java 8 to 17 Runtime Modernization Program Playbook

A fleet program to upgrade Java services from Java 8 to a modern LTS runtime with build, module, and dependency modernization.

Software Supply Chain Security Program Playbook

A program to secure the build-to-deploy pipeline with SBOMs, artifact signing, provenance attestation, and SLSA-aligned controls.

Container Migration Program Playbook

A program to migrate VM-based and legacy applications into containers with hardened images, registries, and orchestrated deployment.

Model Serving Migration Playbook

A phased program to migrate ML model serving from bespoke endpoints to a standardized, autoscaling, observable serving platform.

Checklists5

Kubernetes Production Readiness Checklist

Confirm a Kubernetes cluster and its workloads are secure, observable, and resilient before serving production traffic.

Container Security Hardening Checklist

Harden container images, build pipelines, and runtime so containerized workloads resist compromise and supply-chain attacks.

Kubernetes Cluster Setup Checklist

Provision a new managed Kubernetes cluster with the networking, security, and platform add-ons teams need from day one.

Security Hardening Checklist

Reduce the attack surface of an application and its infrastructure across identity, network, runtime, and supply chain.

SBOM & Supply-Chain Security Review Checklist

Verify software supply-chain integrity through SBOM generation, dependency provenance, build integrity, and artifact signing.

Stacks4

Knative Serverless Containers Stack

Kubernetes-based serverless stack using Knative for scale-to-zero, request-driven container workloads with event-driven autoscaling.

GCP Serverless Stack

Google Cloud serverless stack using Cloud Run and Firestore for container-based, scale-to-zero applications with managed NoSQL storage.

Serverless Containers Stack

Cloud stack running standard OCI containers on managed serverless platforms for scale-to-zero, pay-per-use workloads without cluster management.

AWS ECS Fargate Containers Stack

Managed container stack running Docker workloads on AWS ECS with Fargate serverless compute, behind a load balancer, without managing servers or clusters.

Comparisons11

EKS vs GKE

Amazon EKS and Google GKE are the leading managed Kubernetes services. GKE is more automated and mature; EKS offers deepest AWS integration.

ECS vs EKS

Amazon ECS is AWS's simpler proprietary container orchestrator; EKS is managed Kubernetes. ECS trades portability for ease; EKS trades simplicity for the open ecosystem.

Fargate vs Lambda

AWS Fargate runs serverless containers; AWS Lambda runs serverless functions. Fargate suits long-running services; Lambda suits short, event-driven work.

Docker vs Podman

Docker is the original container engine with a central daemon; Podman is a daemonless, rootless-friendly, drop-in alternative with strong Kubernetes affinity.

Kubernetes vs Nomad

Kubernetes is the dominant, feature-rich container orchestrator; HashiCorp Nomad is a simpler, lightweight scheduler for containers and non-containerized workloads.

Helm vs Kustomize

Helm packages Kubernetes apps as templated, versioned charts; Kustomize overlays plain YAML without templates. Helm suits distribution; Kustomize suits simple in-house config.

VMs vs Containers

Virtual machines virtualize hardware with a full guest OS; containers virtualize the OS, sharing the host kernel. VMs offer stronger isolation; containers offer density and speed.

Serverless vs Containers

Serverless abstracts away infrastructure and scales to zero; containers give portable, full control over the runtime. The choice balances operational simplicity against flexibility.

Cloud Run vs Cloud Functions

Google Cloud Run runs serverless containers; Cloud Functions runs serverless functions. Cloud Run offers more flexibility; Cloud Functions is simpler for event glue.

Traefik vs NGINX

Traefik is a cloud-native reverse proxy with automatic service discovery; NGINX is a mature, high-performance web server and proxy with manual configuration.

containerd vs CRI-O

containerd and CRI-O are the two main Kubernetes container runtimes. containerd is general-purpose and widely adopted; CRI-O is minimal and Kubernetes-only by design.

Benchmarks3

Benchmark

Container Startup Time Benchmark

Measures how quickly a container goes from launch to ready, covering image pull, runtime creation, and application readiness for scaling and resilience.

Benchmark

Kubernetes Scheduling Latency Benchmark

Measures how quickly the Kubernetes scheduler places pods on nodes and how the control plane scales as pod, node, and churn counts grow.

Benchmark

Container Image Vulnerability Density Benchmark

Measures the count and severity of known vulnerabilities per container image, normalized by size or package count, to compare image security posture.

FAQs14

What is a container?

A container is a lightweight, standalone unit that packages an application together with its dependencies, libraries, and configuration so it runs con...

What is the difference between a Docker container and a virtual machine?

A virtual machine (VM) virtualizes hardware and runs a full guest operating system on top of a hypervisor, so each VM carries its own kernel and is he...

What is Kubernetes?

Kubernetes is an open-source platform for automating the deployment, scaling, and operation of containerized applications. It groups containers into l...

What is the difference between a Kubernetes pod and a container?

A container is a single packaged process, while a pod is the smallest deployable unit in Kubernetes and can hold one or more containers that share the...

When should I use Kubernetes?

Kubernetes makes sense when you run many containerized services that need automated scaling, self-healing, rolling updates, and consistent deployment ...

What is a sidecar container?

A sidecar is a secondary container that runs alongside the main application container in the same pod to extend or support it without changing the app...

What is a Kubernetes ingress controller?

An ingress controller is a component that implements Kubernetes Ingress resources, routing external HTTP and HTTPS traffic to services inside the clus...

What is a container image?

A container image is a read-only template that contains everything needed to run an application: code, runtime, libraries, environment variables, and ...

What is a container registry?

A container registry is a storage and distribution system for container images, allowing them to be pushed after a build and pulled at deployment time...

What is container orchestration?

Container orchestration is the automated management of the lifecycle of containers across a cluster of machines, including scheduling, scaling, networ...

What is a Kubernetes namespace?

A namespace is a way to divide a single Kubernetes cluster into multiple virtual clusters, providing a scope for names and a boundary for resources. N...

What does cloud native mean?

Cloud native describes an approach to building and running applications that fully exploits the elasticity, automation, and managed services of the cl...

What is a Kubernetes service?

A Kubernetes Service is an abstraction that gives a stable network identity and address to a dynamic set of pods, since pods are ephemeral and their I...