More in DevOps & Cloud — page 41
Kubelet: The Node Agent of Kubernetes
The kubelet is the primary agent on each Kubernetes node, ensuring containers described in PodSpecs are running and healthy. It watches the API server for work and reports status back. The footgun is trying to manage it directly; always use the API server.
etcd: Kubernetes's Single Source of Truth
etcd is the distributed key-value store that acts as the brain for a Kubernetes cluster, storing its entire configuration and state. The API server uses it to persist all objects, from Pods to Secrets.
Labels and Selectors: The Glue of Kubernetes
Labels are key-value tags for organizing Kubernetes objects; selectors are queries to find them. This is how a Service finds its Pods. The main footgun is a mismatched selector, which orphans Pods from the Deployment that created them.
Kubernetes Pods: The Atomic Unit of Deployment
A Pod is the smallest deployable unit in Kubernetes, a wrapper for one or more containers that run together on one machine. It's used for tightly coupled 'sidecar' helpers, like a log shipper.
Container Image Signing: Verifying What You Run
Think of image signing as a digital "tamper-evident seal" on your containers. It proves who built an image and that it hasn't been altered. This is crucial for production systems to prevent running malicious code.
Harbor: A Private, Secure Artifact Registry
Think of Harbor as a private Docker Hub with built-in security. Use it to scan images for vulnerabilities, enforce role-based access control, and sign artifacts before deploying to Kubernetes.
OCI Image Manifest: The Recipe for a Container Image
An OCI Image Manifest is the recipe for a single container image, listing its configuration and filesystem layers for one specific architecture. It's what a runtime uses to assemble an image like `ubuntu:22.04` on your `linux/amd64` machine.
Docker Registry Mirror: A Local Cache for Faster Pulls
A registry mirror is like a CDN for Docker images, caching public images on your local network to speed up pulls and avoid rate limits. Use it in CI/CD pipelines to reduce build times. The footgun: you can't `docker push` to a mirror; it's a.
Image Digest: The Immutable Image Identifier
An image digest is a unique fingerprint for a container image, guaranteeing you get the exact version you expect. Use it in production to pin an image, preventing unexpected updates from mutable tags like `:latest`. The footgun is assuming a tag is immutable.
Artifact Registry: Google's Universal Package Manager
Artifact Registry is a private, universal package manager for all your software components, not just Docker images. Use it to store your company's Docker images, Java JARs, and Helm charts in one place, integrated with GCP CI/CD.
Amazon EC2: Rentable Virtual Servers on AWS
Amazon EC2 is like renting virtual computers, letting you run applications without buying physical hardware. It's used for scalable deployments where you can launch and terminate servers as needed, paying only for what you use.
Docker Image Prune: Reclaim Your Disk Space
Docker image prune is a garbage collector for your local Docker setup, deleting unused images to free up disk space. Use it when low on storage after many builds. The footgun: by default, it only removes *dangling* (untagged) images, not all unused ones.
Docker Login: Authenticating to a Container Registry
docker login saves your credentials for a container registry, letting you push and pull private images. Use it before interacting with private repos on Docker Hub, ECR, or GCR. The footgun: credentials are often stored unencrypted by default.
Docker Push and Pull: Moving Container Images
Think of `docker push` and `pull` like `git push` and `pull`, but for container images. They move images between your machine and a remote registry. A common mistake is forgetting to tag an image with the registry's full address before pushing.
Docker Hub: The Central Repository for Containers
Think of Docker Hub as the GitHub for Docker images. It's a central repository from Docker, Inc. for finding, storing, and sharing pre-built software containers to automate code deployment.
Docker Compose Secrets: Keep Credentials Out of Your Code
Docker Compose Secrets inject sensitive data into containers as files at runtime, keeping credentials out of your version-controlled `docker-compose.yml`. Use them for API keys and passwords. The footgun: your app must read from a file, not an env var.
Extending Compose Files for Different Environments
Think of extending Compose files like CSS for your services; a base file defines the structure, and override files style it for different environments. This is used to manage settings like local code mounts for dev vs. restart policies for prod.
Docker Compose Profiles: Activate Service Groups
Docker Compose profiles let you toggle groups of services on or off within a single `compose.yaml` file. Use it to separate your core app from debugging utilities or to define a "local dev" setup versus a "CI" setup.
Building Images with Docker Compose
Docker Compose builds images from a `compose.yml` file, turning a Dockerfile into a runnable service within a multi-container app. It's for local dev where you need a database and backend to start together. The footgun: `up` won't rebuild without `--build`.
Docker Compose: Control Startup with `depends_on`
`depends_on` controls service startup order in Docker Compose, ensuring a database starts before your app. The footgun: it only waits for the container to start, not for the application inside to be ready. Use `healthcheck` for true readiness.