Components of Docker

a)         Docker daemon – which is the server

b)         Docker Client

c)         Docker Images – Source code for containers

d)         Docker Registries – This is where docker stores images we build. There are private and public registries. The public registry is called docker hub

e)         Docker Container – Is the organizational unit of docker

2. Docker pause suspends all processes in the specified container while Docker unpause un-suspend all processes in the specified containers

3. Docker stop gracefully shut down container while Docker kill immediately stops/terminate containers

4. Docker Exec – executes new command / creates a new process in the container while Docker attach just connects to a running container using the container’s ID or name

5. Dockerfile Instruction – lists of commands a user could call on the command line to assemble an image

6. Entry Point specifies a command that will always be executed when the container starts. On the other hand, CMD defines default commands and/or parameters for a container.

The Global “ Container Infrastructure Software Market” 2021 Research report produces information with reference to market size, share, trends, growth, cost structure, capacity, revenue, and forecast 2026. This report also contains the general and comprehensive study of the Container Infrastructure Software market with all its aspects influencing the growth of the market. This report is a full-scale quantitative survey of the Container Infrastructure Software industry and provides data for building strategies to expand the market growth and effectiveness.

Executive summary:

The research report on Container Infrastructure Software market comprises a thorough evaluation of the past and present business scenario to deliver a conclusive overview of the industry’s growth patterns over 2021-2026. It casts light on the sizes and shares the markets and sub-markets, emphasizing on the primary growth stimulants, obstacles, and lucrative prospects impacting the business dynamics.

As per expert analysts, Container Infrastructure Software market is predicted to record notable growth over the study period, bolstering at XX% CAGR throughout.

The research literature also includes actionable insights into the competitive landscape, stressing on the well-known strategies employed by major contenders to enjoy strong profit margins in the upcoming years. In addition, the document answers all queries relating to implications of COVID-19 pandemic.

Market snapshot:

Geographical outlook:

Key regional contributors of Container Infrastructure Software market are Americas, APAC, Europe, Middle East & Africa.
Market share in relation to the consumption volume and value of each regional market is taken into account.
Role of key regions to the overall industry progression is computed.
Product landscape outline:

The document segments the product terrain of Container Infrastructure Software market into Mobile Phone , Tablet and Computer.
Industry share of every product segment is given.
Data relating to overall revenue generated and total sales amassed by every product type are provided.
Application spectrum summary:

The application spectrum of Container Infrastructure Software market is bifurcated into Monitoring and Logging , Security , Continuous Deployment , Management and Orchestration , Networking and Data Management Services and Others.
Estimates for consumption volume and value of every application scope are supported with stats.
Approximations for each application segment’s market share over the analysis period are enumerated as well.
Competitive arena overview:

Top companies in Container Infrastructure Software market is Dell EMC , HPE , Microsoft , Broadcom , Canonical , Oracle Corporation , Cray , Cavium , Docker , Cisco , Mellanox , SUSE , Supermicro , IBM , Intel , Inspur , WiWyn , Lenovo , Huawei and White Box QCT.
The document offers a business overview of all the mentioned players.
Records of net revenue, pricing models, operating profits, sales, and other financial attributes of each organization are systematically sorted.
Manufacturing facilities and operating areas of the listed players are given.
Up-to-date data on partnerships, associations, and new entrants in the domain are also presented in the study.

What will be the Container Infrastructure Software market scale and growth rate in the estimate years from 2021 to 2026?
What are the significant driving factors of the Container Infrastructure Software market?
What are the opportunity and challenges in front of the market?
Who are the key vendors in the Container Infrastructure Software market?
What are the trending features manipulating market equity?
What are the key products of Porter’s five forces model?
what are the global prospects for expanding the global Container Infrastructure Software market?
Reasons why you should buy this report

Understand the current and future of the Container Infrastructure Software Market in both developed and emerging markets.
The report assists in realigning the business strategies by highlighting the Container Infrastructure Software business priorities.
The report throws light on the segment expected to dominate the Container Infrastructure Software industry and market.
Forecasts the regions expected to perceive Rapid growth.
The latest developments in the Container Infrastructure Software industry and details of the industry leaders along with their market share and strategies.
Saves time on the entry level research as the report contains important data concerning about growth, size, leading players and segments of the industry.
Save and cut time carrying out entry-level research by distinguishing the growth, size, leading players and segments within the global Market.

Anchore, the leading providers of continuous security and compliance for containers, has announced an integration with GitLab, the complete DevSecOps platform, delivered as a single application. With this integration, organizations will be able to automate security and compliance checks from the early stages of the development cycle, speeding software development and reducing risks. Anchore also announces it has joined the GitLab partner program.

Anchore now integrates seamlessly with GitLab to simplify security and compliance workflows for developers and to enable DevSecOps practices. Anchore performs deep container image scanning that identifies vulnerabilities and surfaces a wide range of security and policy infractions, including vulnerabilities and other risks during development. Together, the Anchore and GitLab security integrations will:

Display vulnerability results of container scans directly in GitLab security dashboards
Surface these findings in merge requests that identify changes needed to remediate issues
Enable updating of merge requests with a package version to resolve vulnerabilities
Seamlessly manage the risk profile in one place through GitLab’s Risk Management Framework (RMF), reducing the friction of typical software security scanning

Digital transformation has changed software development practices as organizations seek to deliver applications more quickly and update them more frequently. This shift, combined with increasing cybersecurity threats, requires developers to implement security and compliance checks throughout the DevSecOps life cycle. The integration between Anchore and GitLab helps to automate these DevSecOps best practices for enterprises, government agencies, and open source communities,” said Saïd Ziouani, Anchore CEO and Cofounder.

“Strengthening the software development security and compliance postures of enterprises and public sector organizations is paramount to the missions of both GitLab and Anchore. We are pleased to partner through this integration to help our joint customers to increase their speed to mission delivery and to reduce the risks associated with software development,” said GitLab Vice-President of Global Channels, Michelle Hodges.

The U.S. Department of Defense (DoD) uses both Anchore and GitLab as part of their Platform One Initiative to speed the development of secure and compliant software. Anchore is used to develop hardened containers for Iron Bank (DoD’s software repository for containers) based on DoD best practices.

“Today, more than ever before, security is the most essential aspect of software development for government and critical infrastructure—and is the core of the DoD DevSecOps Initiative and Platform One. Now developers have the ability to push validated code into production on an ongoing basis, resulting in shorter development cycles, less debugging, and more rapid feature development,” said Major Robert Slaughter, Director of DoD Platform One.

CBA has provided its first detailed look at a container-as-a-service platform it stood up for development teams, and the guardrails wrapped around it to meet regulatory and security requirements.

Lead engineer Dário Nascimento told AWS re:Invent 2020 that the bank built the platform on an AWS stack and is using infrastructure-as-code practices and tools to manage configurations and compliance.

The bank – an AWS customer since 2012 – was cited in a recent blog by AWS chief evangelist Jeff Barr, though it had been unclear for some time where its focus with the cloud lay.

It is now clear that much effort of late has gone into the container-as-a-service platform and into containerising applications across more than one internal business unit or “department”.

In notes promoting the session, AWS said CBA had “built a platform to run containerised applications in a regulated environment and then replicated it across multiple departments using Amazon EKS, AWS CDK, and GitOps.”

EKS is Amazon’s managed Kubernetes service, while CDK – cloud development kit – offers a framework for companies to manage cloud infrastructure as code.

GitOps, meanwhile, is “an operating model for the delivery and management of cloud native applications on Kubernetes.”

“The core idea of GitOps is having a Git repository that always contains declarative descriptions of the infrastructure currently desired in the production environment and an automated process to make the production environment match the described state in the repository,” Walmart Japan cloud solution architect Bhargav Shah writes in an explainer.

“If you want to deploy a new application or update an existing one, you only need to update the repository – the automated process handles everything else.

“It’s like having cruise control for managing your applications in production.”

CBA’s Nascimento said that the bank’s use of GitOps – and the architecture of the container-as-a-service platform generally – was optimised for service security and resiliency, and to give auditors and financial regulators confidence in the cloud-hosted infrastructure.

In that way, CBA is treading a similar path to that of other banks with cloud ambitions: NAB, for example, has its CAST framework which it used to get the Australian Prudential Regulation Authority’s (APRA’s) blessing.

“We kind of use GitOps and infrastructure-as-code as an immutability firewall,” Nascimento said.

“One of the core principles is that our applications must be declared in code in Git, defining the state we want the system to be, [the] drivers and the operations that we want it to execute, and then Gitops operators such as Kubernetes and [AWS] CloudFormation systems will ensure the services reflects the state you defined that in code.

“That means humans only need read-only access for observability purposes.”

The container-as-a-service platform is also intended in part to make the job of auditors easier by implementing many security and compliance controls automatically, with development teams adding only a few controls of their own for their particular service or application.

“Financial institutions are regulated environments and must perform risk management to be compliant with the expectations of security and regulators,” Nascimento said.

“I consider [security and regulators] like ‘bar raisers’ for processes and mechanisms.

“Risk management is a constant process that assesses what risks exist and then find controls to mitigate those risks. Controls are like requirements, defined by security, by risk, by engineering teams, usually based on standards such as ISO, PCI or industry regulations. These requirements aim to detect, prevent and mitigate something that might happen.

“Auditors will demand evidence proving that controls have been implemented to ensure that the system is actually compliant.”

Nascimento noted that if each internal team composed its own Kubernetes platform, each would then “have to repeat this auditing process and provide evidence that their version of the platform is also secure and compliant.”

“This approach will definitely not scale,” he said.

“So we built a container-as-a-service platform with the … risk assessment to ensure the platform is secure and reliable, and just like with the ‘AWS shared responsibility model’, we implemented controls on behalf of the users to reduce the length of the architecting process.

“Users will only need to implement the few controls where they have to create a new service, and the auditors will absolutely have a more expansive trust base so the auditing process can be much quicker.”

Nascimento said the container-as-a-service platform also helped CBA “scale software development in an innovative, sustainable, reliable and secure manner.”

Aside from aiding auditors, GitOps was also intended to “empower developers to follow best practices so that services are well configured and reliable.”

“Service continuity and reliability is a must in the financial industry so when we designed this container platform, we optimised for service security and resiliency; in other words, for minimising the access permissions and the blast radius,” Nascimento said.

“We converged on running one cluster per AWS account and two accounts per system, a non-prod account and production account.

“A system itself is composed by multiple services within a single business unit.”

The multi-account strategy enabled CBA to effectively segregate systems, such that if one failed, it did so within “a well-defined blast radius” and did not impact other systems.

Nascimento did not talk about which business units run workloads on the container-as-a-service platform, nor the types or numbers of workloads, instead focusing purely on the architecture and guardrails the bank had laid down for the platform.

VMware shined light on its newly enhanced Container Networking platform that has gained the open source Antrea networking product that provides developers with the ability to connect containers directly to each other. The halo was part of VMware’s broader NSX update.

The Container Networking with Antrea mouthful is VMware’s commercial offering of the Project Antrea platform, which the vendor launched last year. That project was established as a purpose-built Kubernetes networking platform for public and private clouds. It’s built on Open vSwitch and can run in any Kubernetes environment.

The new product works with VMware’s NSX-T platform to support container connectivity for Kubernetes clusters in a software-defined data center. It can also work with VMware’s Tanzu Kubernetes Cluster on vSphere and other public clouds.

Tom Gillis, SVP and GM of VMware’s Networking and Security business unit, described the product as part of a “two-tier” system allowing developers to “deploy their own network solution to allow the little containers to talk to each other and connect” within a network cluster. The other tier is that the platform uses NSX for the connection from a cluster into a virtual machine (VM).

Gillis explained that this tiered approach allows for high scalability, or “cloud scale” as he called it, that can link together “hundreds of thousands of these little containers that need to be managed.”

This reality places security practitioners in a difficult position. You must simultaneously secure the container runtime and orchestration layer, validate the applications and libraries packed inside each image, maintain rigor in every other area of your program, and rapidly build expertise across container engines, orchestration platforms, microservice patterns, and cloud-native tooling. Any force multiplier helps.

The Core Problem: Opacity Inside Container Images

A container image is not simply a binary. It is a layered filesystem that can contain an operating system base, language runtimes, third-party libraries, application code, configuration files, and—if developers are not careful—credentials and secrets. Without deliberate inspection, it is easy to deploy images whose full software bill of materials (SBOM) is unknown, including packages that carry known vulnerabilities.

Traditional vulnerability scanning typically requires a live, network-accessible host. Container images sitting in a registry or on a developer’s workstation are not live hosts. You need a different approach: static image analysis that unpacks each layer of the image and inventories its contents without executing the container.

Anchore Engine: Deep Inspection for Container Images

One open source tool that addresses this problem is Anchore Engine, released under the Apache License 2.0. Anchore Engine unpacks a container image layer by layer and produces a detailed inventory of everything inside, including:

• Operating system packages (RPMs, DEBs, APKs, and others)
• Language ecosystem packages (Python, Ruby gems, Node modules, Java JARs, and similar)
• Runtime versions (JRE, Node.js, Python interpreter, etc.)
• Configuration files that affect container behavior
• Secrets and credentials inadvertently baked into the image

According to Anchore’s own documentation and public statements, the engine then maps the discovered packages against known vulnerability databases, surfacing CVE identifiers for any vulnerable software found. This gives you something functionally similar to a vulnerability scan report, but produced statically against the image—no running container required.

Why Visibility Into Image Contents Matters

Knowing exactly what is inside a container image is valuable in several contexts beyond simple vulnerability detection:

• Software architecture reviews: Image analysis exposes accidental or undocumented dependencies that would otherwise be invisible in design reviews.
• Threat modeling: A complete package inventory makes attack surface analysis much more accurate.
• Secrets management: Automated inspection can flag credentials, tokens, or private keys that developers accidentally included in an image layer.
• Compliance and audit: Regulators and auditors increasingly ask organizations to demonstrate they know what software is running in production. A generated SBOM satisfies that requirement.
• Patch management: When a new CVE is published, you can immediately query which images contain the affected package rather than waiting for a traditional scan cycle.

Integrating Container Image Scanning Into Your Workflow

There is no single right place to run image analysis. The best answer depends on your organization’s maturity, risk tolerance, and pipeline structure. Consider three common integration points:

1. Developer Workstations and Inner Loop

Enabling developers to run image analysis locally gives them immediate feedback. They can identify and remove stale libraries, unnecessary OS packages, or vulnerable base image versions before a single line is pushed to a shared repository. This is the leftmost shift possible and generally the cheapest place to fix a problem.

2. CI/CD Pipeline Gates

Integrating image scanning as a pipeline stage—immediately after the image build step and before the image is pushed to a registry—creates an automated quality gate. A pipeline script can invoke the scanner, evaluate the resulting policy report, and fail the build if images do not meet defined standards (for example, no critical CVEs, no embedded secrets). This is the most impactful integration point for most teams because it prevents vulnerable images from reaching the registry at all.

Anchore Engine exposes a REST API and CLI that are straightforward to call from Jenkins, GitLab CI, GitHub Actions, CircleCI, and similar systems. Pre-built integrations and plugins exist for several of these platforms.

3. Registry and Production Monitoring

Images already in production or sitting in a registry can be analyzed retrospectively. This is especially useful when a new CVE is published and you need to determine your exposure across a large fleet of deployed images. Point Anchore Engine at your registry, analyze the image manifests, and query the results against the new CVE.

Getting Started With Anchore Engine

Anchore Engine is designed to run as a set of containerized services orchestrated with Docker Compose. If you already have Docker and Docker Compose installed, the initial setup requires only a handful of shell commands to pull the Docker Compose configuration file and start the services. No upfront licensing cost is involved for the open source edition.

At a high level, the workflow looks like this:

1. Start the Anchore Engine services using Docker Compose.
2. Add the image you want to analyze (by name or digest) to the engine’s queue.
3. Wait for the analysis to complete (the engine pulls the image, unpacks layers, and builds the inventory).
4. Query the results: package list, CVE matches, policy evaluation outcome.

The engine ships with a default policy that flags the most commonly encountered vulnerability classes. You can customize policies to match your organization’s risk thresholds—for example, blocking on critical or high-severity CVEs while warning on medium-severity findings.

Open Source vs. Commercial Alternatives

Anchore Engine is not the only tool in this space. Other open source options—such as Trivy (from Aqua Security) and Clair (from Quay/Red Hat)—address overlapping use cases. Commercial offerings from vendors including Aqua Security, Prisma Cloud (Palo Alto Networks), Sysdig, and Snyk provide broader platform coverage, managed infrastructure, and enterprise support.

The value of starting with an open source tool is not that it is necessarily better than a commercial product—it is that you can start today. You can validate that image scanning provides real value in your environment, experiment with where it fits best in your pipeline, and build the internal case for a commercial investment if you need one. An open source tool is an ideal on-ramp and a practical stopgap, not necessarily the final destination.

Key Takeaways

• Container images often contain far more software than their owners realize, including vulnerable packages and accidentally embedded secrets.
• Static image analysis does not require a running container, making it applicable to images at any stage of the software supply chain.
• Anchore Engine is a free, Apache-licensed tool that unpacks container images layer by layer and maps their contents to CVE databases.
• The most impactful integration point for most teams is the CI/CD pipeline, where scanning can act as an automated gate before images reach a registry.
• Starting with an open source scanner costs nothing but time and provides immediate visibility, even if a commercial solution is the eventual goal.

Original article sourced from TechNewsWorld (technewsworld.com), January 2020.

Whether you are building a new cluster or hardening an existing one, the following ten questions provide a practical framework for identifying security gaps across your container and Kubernetes environment. Bring these to your DevOps and security teams as a starting checklist.

1. Are We Running the Latest Versions of Kubernetes and the Container Runtime?

The majority of exploited vulnerabilities are ones for which a patch already exists. Keeping Kubernetes, your container runtime (such as containerd or CRI-O), and any managed platform components up to date is one of the highest-impact actions you can take. The CNCF security audit identified a number of vulnerabilities in the Kubernetes codebase; subsequent releases addressed many of them. Establish a process to track release notes and apply updates promptly — ideally within a defined SLA based on the severity of disclosed CVEs.

2. Are There Images That Have Not Been Scanned Within a Defined Threshold?

An image that passed a vulnerability scan at build time may be exposed to newly disclosed CVEs days or weeks later. Define a maximum acceptable scan age (for example, seven days) and enforce it as a policy gate. Any image exceeding that threshold should trigger a rescan before it is permitted to run in production. This is especially important for zero-day vulnerabilities discovered after the initial scan. Integrate image scanning into your CI/CD pipeline and enforce it at the admission-control layer in Kubernetes.

3. Where Are Our Images Coming From — and Can We Verify Their Provenance?

Developers under delivery pressure will sometimes pull base images from public or unofficial registries that lack security controls. Every image used in production should originate from a registry that is trusted, access-controlled, and fully integrated with your vulnerability scanner. Enforce this through an admission controller or OPA/Gatekeeper policy that rejects pods referencing images from non-approved registries. Consider implementing image signing (for example, with Sigstore/Cosign) so that provenance and integrity can be cryptographically verified at deploy time.

4. Are There Pods Without Any Network Policies?

By default, Kubernetes allows unrestricted pod-to-pod communication across a cluster. A NetworkPolicy resource restricts which pods can communicate with a given pod, effectively isolating it. Any pod without an associated network policy can reach — and be reached by — every other pod in the namespace. In the event of a breach, this dramatically expands the blast radius. Audit your namespaces for pods that lack network policies and apply a default-deny ingress/egress rule as a baseline, then explicitly allow only the traffic that is required.

# Example: default-deny-all NetworkPolicy for a namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress

5. Are There Permitted Network Paths That Are No Longer Needed?

Overly permissive network policies accumulate over time as services evolve. An allowed communication path that is no longer used still represents an attack surface. Periodically review your NetworkPolicy rules and cross-reference them with observed network flows (many CNI plugins and service meshes can expose this data). Remove any rules that permit traffic between services that no longer need to communicate. The principle of least privilege applies to network access just as much as it does to IAM.

6. Is Role-Based Access Control (RBAC) Actually Enforced?

Kubernetes RBAC is the primary mechanism for controlling who — and what — can interact with the Kubernetes API. Modern Kubernetes distributions enable RBAC by default, but clusters that were upgraded from older versions may still have the legacy Attribute-Based Access Control (ABAC) authorizer active alongside RBAC, which can undermine it. Verify that RBAC is enabled and that ABAC is disabled. Beyond that, audit your ClusterRoleBinding and RoleBinding objects for overly broad grants — particularly any binding that references the cluster-admin role or uses wildcard resource/verb permissions.

7. Are Any Containers Running With the Privileged Flag?

A container launched with securityContext.privileged: true receives all Linux capabilities and has the same access to the host kernel as a root process running directly on the node. If a privileged container is compromised, an attacker effectively has host-level access — including the ability to escape the container entirely. Audit running workloads for the privileged flag and remove it wherever it is not strictly necessary. For workloads that require elevated privileges, prefer granting only the specific Linux capabilities needed rather than enabling full privilege.

# Check for privileged containers across all namespaces
kubectl get pods --all-namespaces -o json \
  | jq '.items[] | select(.spec.containers[].securityContext.privileged == true) \
  | .metadata.namespace + "/" + .metadata.name'

8. Are All Container Root Filesystems Mounted as Read-Only?

One of the key benefits of container-based deployments is immutable infrastructure: a container image represents a known, fixed state. Enforcing a read-only root filesystem (readOnlyRootFilesystem: true in the container’s security context) prevents an attacker who has gained code execution inside the container from writing malicious files, installing tools, or modifying application binaries at runtime. Applications that legitimately need to write data at runtime should use explicitly mounted volumes rather than writing to the root filesystem.

9. Are Any Containers Sharing the Host Network Namespace?

Setting hostNetwork: true in a pod spec causes the container to share the network namespace of the underlying node. This means the container can see and interact with all network interfaces on the host, including traffic to and from other pods that would otherwise be isolated. A compromised container running in the host network namespace can sniff traffic, bind to privileged ports, and interfere with node-level networking. Restrict hostNetwork usage with a Pod Security Admission policy or OPA/Gatekeeper constraint, allowing it only for specific, justified system-level workloads.

10. Can We Observe Which Processes Are Running Inside Containers Across All Clusters?

Runtime visibility is essential for threat detection. Knowing which processes are expected to run inside a container allows you to detect anomalies — for example, a shell spawned inside an application container, or a network-scanning tool executed post-compromise. Tools such as Falco, Sysdig Secure, and similar eBPF-based runtime security tools can monitor syscall activity and alert on unexpected process executions. Define a baseline of expected process behavior for each workload and treat deviations as security events that require investigation.

Putting It Together: A Security Assessment Checklist

• Kubernetes and container runtime versions are current and patched.
• All images are scanned on a defined schedule; stale scans block deployment.
• Images are only pulled from approved, scanner-integrated registries.
• Every pod has an associated NetworkPolicy; namespaces default to deny-all.
• Network policies are reviewed periodically and unused paths are removed.
• RBAC is enabled and enforced; ABAC is disabled; bindings follow least privilege.
• No production workload runs with privileged: true without documented justification.
• Container root filesystems are mounted read-only; writable volumes are explicit.
• Use of hostNetwork: true is restricted to approved system-level pods.
• Runtime process visibility is in place and anomalous executions trigger alerts.

Security in a Kubernetes environment is not a one-time configuration exercise — it is an ongoing practice. Revisit these questions regularly as your cluster evolves, new workloads are deployed, and new CVEs are disclosed.

Original source: containerjournal.com

Overview

Sectigo, a commercial Certificate Authority (CA) and PKI management vendor, announced integrations between its Sectigo Certificate Manager platform and five widely used DevOps configuration management and container orchestration tools: Docker, Kubernetes, Ansible, Terraform, and HashiCorp Vault. The stated goal is to give operations teams a single, centralized control plane for issuing, renewing, and revoking certificates across heterogeneous DevOps environments—without requiring deep PKI expertise from every team member who touches infrastructure.

Why PKI in DevOps Is Difficult

Modern DevOps environments are composed of hundreds or thousands of short-lived containers and microservices, each of which may need a certificate for mutual TLS authentication, service identity, or compliance purposes. This creates several practical challenges:

• Scale: Certificate volumes grow rapidly as container counts increase. Manual issuance and renewal does not scale.
• Short lifetimes: Containers and ephemeral workloads may live for minutes or hours, making traditional certificate lifecycle processes impractical.
• Decision complexity: IT generalists operating DevOps pipelines must make choices about key sizes, certificate term lengths, and trust hierarchies—topics that normally require specialized PKI knowledge.
• Compliance and auditability: Regulated industries require proof that certificates were issued according to policy and that expired or revoked certificates are tracked.

As Lindsay Kent, Sectigo’s VP of Product Management, noted at the time: organizations implementing DevOps often find themselves needing to become PKI experts overnight, selecting and configuring public key schemes without a background in the field. Mistakes in key management or certificate policy can leave containerized environments exposed or out of compliance.

How Sectigo Certificate Manager Integrates

Sectigo Certificate Manager connects to the supported DevOps tools using one of two mechanisms:

• ACME (Automated Certificate Management Environment): The IETF-standardized protocol (RFC 8555) used by tools such as cert-manager for Kubernetes, enabling fully automated certificate issuance and renewal without human intervention.
• Sectigo RESTful APIs: For tighter integration scenarios where custom workflows, certificate policy enforcement, or reporting are required.

Enterprises that already use a different CA or PKI implementation for issuance can still use Sectigo Certificate Manager in monitoring and reporting mode—tracking certificate deployments across their environment without migrating issuance workflows.

The Five Integrations Explained

Docker

Docker packages applications into portable containers that run consistently across environments. The Sectigo integration allows the platform to issue short-lived public or private TLS certificates directly to applications running inside Docker containers. This is particularly relevant when containers expose HTTPS endpoints or need client certificates for service-to-service authentication.

Kubernetes

Kubernetes automates deployment, scaling, and management of containerized workloads. The Sectigo integration works with the Kubernetes-native certificate controller, enabling certificate issuance and renewal to follow the same declarative, manifest-driven workflow that Kubernetes operators already use. Teams can define certificate resources as part of their cluster configuration and have Sectigo Certificate Manager fulfil those requests automatically.

Ansible

Ansible is a popular agentless configuration management and server provisioning tool. Sectigo’s Ansible module targets lifecycle management for large certificate volumes across heterogeneous environments—covering a mix of Linux, Windows, and other platforms from a single playbook. The module abstracts away complex security decision-making, providing a platform-agnostic interface for provisioning and managing both TLS server certificates and client certificates at scale.

Terraform

Terraform is an open-source infrastructure-as-code tool from HashiCorp that provisions and modifies infrastructure across cloud and on-premises environments. Sectigo’s Terraform provider enables enrollment, retrieval, and revocation of certificates as part of infrastructure provisioning workflows. When combined with HashiCorp Vault, Terraform can provision infrastructure while Vault handles secure storage of the resulting certificates and private keys.

HashiCorp Vault

HashiCorp Vault provides centralized secrets management, controlling access to passwords, API keys, and certificates based on application identity and user identity. Sectigo Certificate Manager can assign certificates to applications protected by Vault and store the private keys and certificates used across DevOps environments inside Vault’s encrypted secrets engine. This combination addresses both the issuance side (Sectigo) and the secure storage and access-control side (Vault) of certificate management.

Industry Context

Fernando Montenegro, Principal Analyst at 451 Research, commented on the announcement: “Certificate-based authentication is a foundational element in many DevOps use cases, and one that often grows in complexity when an enterprise considers details such as public versus private servers, client authentication, and more. We see a notable benefit for organizations to be able to use certificate management platforms that can address this complexity while integrating with popular configuration management and orchestration tools.”

The observation reflects a broader industry trend: as zero-trust network architectures gain traction, certificate-based mutual authentication between services is becoming a baseline requirement rather than an optional hardening step. Tools that bridge the gap between PKI operations and DevOps toolchains reduce the friction of adopting these practices at scale.

Key Takeaways for DevOps and Platform Engineering Teams

• Automated PKI integrations reduce the manual toil of certificate management in environments with high container churn.
• Using ACME or native API integrations means certificate issuance and renewal can be driven by the same infrastructure-as-code tooling already in place—no separate certificate management workflow required.
• Centralized reporting and monitoring across multiple issuance sources helps satisfy compliance and audit requirements without requiring teams to query individual tools.
• Separating issuance policy (managed by a CA platform) from deployment tooling (Ansible, Terraform, Kubernetes) gives security teams policy control without blocking DevOps velocity.
• HashiCorp Vault integration addresses the private key custody problem: even if a CA issues a certificate, the private key needs secure, audited storage with access controls—Vault provides that layer.

This article is based on a Sectigo press release and Help Net Security report from September 2019. Integration capabilities and product features may have changed since the original announcement. Consult Sectigo’s current documentation for up-to-date integration details.

Series overview:

• Part 1 – Containerising a Blazor Server App
• Part 2 – Containerising a Blazor WebAssembly App
• Part 3 – Publishing to Azure Container Registry using Azure Pipelines (this post)

Overview

Parts 1 and 2 covered how to containerise Blazor applications so they run locally inside Docker containers. The natural next step is automation: how do you build Docker images as part of a CI pipeline, and where do you store those images once they’re built?

This post answers both questions. You’ll learn how to:

• Create an Azure Container Registry (ACR) to store Docker images.
• Set up an Azure Pipelines CI build that automatically builds your Docker image on every push.
• Configure the pipeline to push the built image to ACR using a service connection.

The example project is hosted on GitHub, but Azure Pipelines supports many other source control providers, so the approach translates with minimal adjustment.

Creating an Azure Container Registry

Azure Container Registry (ACR) is Azure’s managed Docker image hosting service, conceptually similar to Docker Hub. It provides a private registry where you can store, version, and pull container images.

Step 1: Open Container Registries in the Azure Portal

Log in to the Azure Portal, select All Services from the left-hand menu, and search for Container registries.

Step 2: Add a New Registry

When the blade loads, click Add at the top of the screen.

Step 3: Configure the Registry

Fill in the Create container registry form:

• Registry name – must be globally unique within Azure.
• Subscription, Resource group, and Location – choose values appropriate for your environment.
• Admin user – leave this disabled. You will connect Azure Pipelines to the registry using a service connection, which is the recommended approach.
• SKU – select the pricing tier that fits your needs. Basic is sufficient for development and testing scenarios.

Click Create. The registry will be provisioned within a minute or two. Once it’s ready, move on to setting up Azure Pipelines.

Setting Up Azure Pipelines

Azure Pipelines is a CI/CD service that is part of Azure DevOps. It can build, test, and deploy code targeting any platform or cloud. A free tier is available for public and private projects.

Step 1: Create an Azure DevOps Project

Sign in at dev.azure.com. If you don’t already have an organisation, you’ll be prompted to create one. Then click New Project in the top-right corner, give the project a name, and set its visibility (public or private).

Click Create and you’ll land on the project home screen.

Step 2: Create a New Pipeline

In the left-hand menu, navigate to Pipelines → Builds, then click New pipeline.

Step 3: Connect to Source Control

The new pipeline wizard walks you through four steps. The first is connecting to your source code repository. Select GitHub (or whichever provider hosts your code — Azure Repos, Bitbucket, and others are also supported).

Authorise access if prompted, then select the repository you want to build from the list.

Step 4: Configure the Pipeline Template

In the configuration step, you’ll see a list of pipeline templates. Click Show More if needed, scroll down, and select Docker.

A drawer appears asking you to locate your Dockerfile. The path field is case-sensitive. If your Dockerfile uses a lowercase d (i.e., dockerfile rather than Dockerfile), update the field accordingly — for example, **/dockerfile. Click Validate and configure.

Step 5: Review and Save the Pipeline YAML

The wizard generates a azure-pipelines.yml file. Review it, then click Save and run.

You’ll be asked whether to commit directly to main/master or to a new branch. Committing to a feature branch (e.g., azure-pipelines) is recommended — it lets you iterate on the pipeline configuration and merge it via a pull request once everything works correctly.

After the commit, Azure Pipelines triggers a build automatically. When it completes successfully, you’ll see the build summary screen.

At this point the Docker image is being built by Azure Pipelines on every push. The next step is to push that image to your Azure Container Registry automatically.

Publishing the Image to Azure Container Registry

Step 1: Create a Service Connection

Azure Pipelines needs permission to push images to your ACR. You grant this through a service connection.

Go to Project settings (bottom-left of the screen) and select Service connections under the Pipelines section. Click New service connection and choose Docker Registry from the list.

In the modal that appears, select Azure Container Registry, then:

• Give the connection a meaningful name (e.g., AzureContainerRegistry). You’ll reference this name in your pipeline YAML.
• Select your Azure subscription.
• Select the container registry you created earlier.

Click OK to save the connection.

Step 2: Update the Pipeline YAML

Go to Pipelines → Builds, find your pipeline, and click Edit.

Replace the existing Docker task with the following, updating repository and containerRegistry to match your setup:

- task: Docker@2
  displayName: Build and push image to container registry
  inputs:
    command: buildAndPush
    repository: demos/BlazorServerWithDocker
    dockerfile: '**/dockerfile'
    containerRegistry: AzureContainerRegistry
    tags: |
      $(Build.BuildId)

Key changes explained:

• command: buildAndPush — Builds the image and immediately pushes it to the registry in a single task, replacing the earlier build-only command.
• repository — The path within the registry where the image will be stored. If the repository doesn’t exist in ACR, it will be created automatically on first push.
• containerRegistry — The name of the service connection you created in Step 1. This is how the pipeline authenticates to ACR.
• tags — One or more tags to apply to the image. Using the built-in $(Build.BuildId) variable gives each build a unique, traceable tag.

Note on the $(tag) variable: The original source uses $(tag) as the image tag. This is a pipeline variable that must be defined in the pipeline’s variable settings or passed at runtime. Using $(Build.BuildId) is a common alternative that works without additional setup. Verify which approach suits your workflow.

Step 3: Save and Run the Updated Pipeline

Click Save. You can add a commit message in the dialogue that appears before the updated YAML is committed to your branch.

Saving triggers a new build automatically. If it doesn’t, click Run at the top-right of the pipeline editor.

After the build completes successfully, you’ll see a green build summary.

Step 4: Verify the Image in ACR

Head back to the Azure Portal and open your Container Registry. Select Repositories from the left menu. You should see the repository you specified in the pipeline YAML. Click on it to view the image and its tags.

Summary

This walkthrough covered the end-to-end process of automating Docker image builds and publishing with Azure Pipelines and Azure Container Registry:

• Created an ACR instance in the Azure Portal with the Admin user disabled.
• Set up an Azure Pipelines build connected to a GitHub repository.
• Used the Docker pipeline template to generate a working azure-pipelines.yml.
• Added a Docker Registry service connection to authenticate the pipeline to ACR.
• Updated the pipeline task to use buildAndPush, pushing the image to ACR on every build.

Although the example uses a Blazor Server application, the pipeline configuration is not Blazor-specific. Any project with a valid Dockerfile can be built and published to ACR using the same steps.

Original article by Chris Sainty — chrissainty.com

What Is Container Technology?

Container technology allows developers and operators to package an application together with its dependencies, configuration, and runtime into a lightweight, portable unit called a container. Unlike traditional virtual machines, containers share the host operating system kernel, making them faster to start and more resource-efficient. Containers have become a cornerstone of modern DevOps pipelines, enabling consistent deployments across development, staging, and production environments.

The global market for container technology encompasses runtime engines, orchestration platforms, management tooling, and the cloud services that wrap them. Adoption spans industries including financial services, healthcare, retail, telecommunications, and the public sector.

Key Players in the Container Technology Market

The competitive landscape includes both open-source projects and commercial platforms. The following vendors and projects are frequently cited as major participants:

• Docker – Popularised the modern container format and the OCI image specification. Docker Desktop and Docker Hub remain widely used by developers, while the commercial Docker Business offering targets enterprises.
• Kubernetes – The de-facto standard for container orchestration, originally developed at Google and donated to the Cloud Native Computing Foundation (CNCF). Kubernetes manages scheduling, scaling, networking, and self-healing of containerised workloads across clusters.
• Apache Mesos – A distributed systems kernel that abstracts CPU, memory, and storage resources across a cluster. Mesos supports multiple frameworks and was widely adopted before Kubernetes gained dominance; its Marathon scheduler handled long-running containerised services.
• AWS (Amazon Elastic Container Service / EKS) – Amazon offers managed container services including ECS (proprietary orchestration) and EKS (managed Kubernetes), tightly integrated with IAM, VPC, and other AWS primitives.
• Microsoft Azure (AKS) – Azure Kubernetes Service provides a managed Kubernetes control plane, with deep integration into Azure Active Directory, Azure Monitor, and Azure DevOps.
• Google Container Engine (GKE) – Google Kubernetes Engine, where Kubernetes itself was born. GKE offers Autopilot mode, which manages node provisioning automatically.
• Red Hat OpenShift – An enterprise Kubernetes distribution from Red Hat (an IBM subsidiary) that adds developer workflows, integrated CI/CD pipelines, and stronger default security policies on top of upstream Kubernetes.
• Oracle Solaris Zones / Containers – Oracle’s OS-level virtualisation predates Docker-style containers; Solaris Zones provide strong isolation at the OS layer and are relevant in legacy enterprise environments.
• Pivotal Software (VMware Tanzu) – Pivotal’s container runtime and application service, now consolidated under VMware Tanzu, targets enterprise application modernisation on Kubernetes.

Market Segments

Container technology markets are typically segmented along the following dimensions:

By Deployment Type

• Public cloud – Managed Kubernetes and container services from hyperscalers (AWS, Azure, GCP).
• Private cloud / on-premises – Self-managed Kubernetes clusters, OpenShift, or Rancher deployed in enterprise data centres.
• Hybrid and multi-cloud – Workloads distributed across public cloud and on-premises infrastructure, often managed through a unified control plane.

By Organisation Size

• Large enterprises – Typically drive early adoption and invest in platform engineering teams.
• Small and medium-sized businesses (SMBs) – Increasingly adopting managed cloud container services to reduce operational overhead.

By End-User Industry

• BFSI (Banking, Financial Services, and Insurance)
• Healthcare and life sciences
• Retail and e-commerce
• Telecommunications
• Government and defence
• Media and entertainment

Geographic Coverage

Market research on container technology commonly breaks down adoption and revenue by the following regions:

• North America – United States, Canada, Mexico. Historically the largest market by revenue, driven by hyperscaler presence and high enterprise cloud adoption.
• Europe – UK, Germany, France, Italy, Spain, Russia. Strong regulatory environment (GDPR) influences on-premises and hybrid deployments.
• Asia-Pacific – China, India, Japan, South Korea, Singapore, Indonesia, Australia. Fastest-growing region by adoption rate, with large domestic cloud ecosystems in China.
• Latin America – Brazil, Argentina, Chile. Emerging adoption, particularly in fintech and retail.
• Middle East and Africa – Saudi Arabia, UAE, Turkey, Egypt, South Africa. Government-led digital transformation programmes driving cloud and container investment.

Key Growth Drivers

Several macro and technical factors have accelerated container adoption:

• Microservices architecture – Breaking monolithic applications into independently deployable services is a natural fit for containers, which isolate each service and its dependencies.
• DevOps and CI/CD adoption – Containers provide reproducible build and runtime environments, reducing the “works on my machine” problem and enabling faster release cycles.
• Cloud-native development – The CNCF ecosystem (Helm, Prometheus, Istio, Envoy, Argo, etc.) has expanded the container tooling landscape significantly.
• Cost efficiency – Higher workload density compared to virtual machines reduces infrastructure spend.
• Portability – A container image built locally can run on any OCI-compliant runtime, simplifying multi-cloud and hybrid strategies.

Key Challenges and Constraints

• Security complexity – Containers share the host kernel, so a kernel vulnerability can affect all containers on a host. Image vulnerability management, runtime security, and least-privilege policies require dedicated tooling (e.g., Trivy, Falco, OPA/Gatekeeper).
• Operational skill gap – Kubernetes has a steep learning curve. Many organisations underestimate the operational burden of running clusters in production.
• Stateful workloads – Containers were originally designed for stateless applications; running databases and other stateful workloads requires persistent volume management and careful operator design.
• Vendor lock-in – While Kubernetes is open source, managed services from cloud providers can introduce proprietary extensions that complicate portability.
• Networking and observability – Service mesh tooling (Istio, Linkerd) adds resilience and observability but also adds latency and operational complexity.

Competitive Dynamics and Market Structure

The container market exhibits several structural characteristics worth noting for practitioners evaluating vendors:

• Commoditisation of the runtime – The container runtime layer (containerd, CRI-O) has been largely commoditised. Competition has shifted to the orchestration, developer experience, and managed service layers.
• Cloud provider consolidation – AWS, Azure, and GCP capture a significant share of container workloads through managed Kubernetes services, creating a competitive disadvantage for independent software vendors.
• Open-source foundations – The CNCF acts as a neutral home for many critical projects, reducing single-vendor control risk for end users.
• Enterprise distribution market – Red Hat OpenShift, SUSE Rancher, and VMware Tanzu compete on enterprise support, security hardening, and integration with existing IT governance frameworks.

What to Look for When Evaluating Container Platforms

When assessing container platforms for enterprise adoption, engineering teams should evaluate the following areas:

• Orchestration maturity – Does the platform offer production-grade scheduling, auto-scaling, rolling updates, and self-healing?
• Security posture – Image scanning, RBAC, network policies, secret management, and runtime threat detection.
• Ecosystem integration – Compatibility with existing CI/CD tooling, monitoring stacks, and identity providers.
• Support model – Commercial SLA, community support, and frequency of upstream patch backports.
• Total cost of ownership – Licensing fees, infrastructure costs, and operational engineering time.

Summary

Container technology has moved from an emerging trend to a foundational layer of modern application infrastructure. The competitive landscape is mature at the runtime and orchestration layers, with differentiation increasingly occurring in developer experience, security tooling, managed service quality, and enterprise support. Engineering teams evaluating container platforms should look beyond marketing claims and assess operational complexity, total cost, and long-term vendor viability alongside technical capability.

This article was updated and expanded from a 2019 market research summary. Technical details reflect the state of the container ecosystem as of the article’s revision date.

What Is Amazon SageMaker?

Amazon SageMaker is AWS’s managed cloud machine learning platform. It is built around four core offerings that support the end-to-end data science workflow:

1. Ground Truth — A managed service for large-scale, on-demand data labeling, used to generate training data for supervised learning algorithms.
2. Training — A managed service to train and tune models at any scale.
3. Inference — A managed service to host pre-built models and run predictions against new data.
4. Notebook — An AWS-hosted Jupyter server that gives data scientists a single interface to manage the above three services alongside general data science tasks.

The hosted Notebook instance is a convenient, batteries-included environment. However, there are real-world scenarios where running an equivalent environment locally — inside a Docker container — is preferable.

TL;DR

• The SageMaker Notebook instance comes pre-loaded with ML frameworks, multiple kernels, GPU support, Git integration, and AWS example notebooks.
• It costs money to run, requires an internet connection, demands AWS Console sign-in, and can be difficult to customize deeply.
• A Docker container that mirrors the Notebook instance environment lets you work locally on any laptop or desktop.
• Replicated features include Jupyter Notebook and JupyterLab, multiple Conda-based kernels, AWS and SageMaker SDKs, the AWS CLI, Docker CLI passthrough, Git integration, a Conda tab, and the SageMaker Examples tab.
• The cloud instance and the local container are complementary, not mutually exclusive. With proper Git integration, you can switch between them seamlessly.

Why Use the Hosted SageMaker Notebook Instance?

Before considering a local alternative, it is worth understanding what the hosted instance provides:

• Complete system on demand. With a few clicks in the AWS Console, you get a fully configured system with the most commonly needed ML libraries and tools — no infrastructure management required.
• Multiple ML kernels. Built-in kernels cover standard Python 2 and 3, popular frameworks (TensorFlow, MXNet, PyTorch, Chainer), and other runtimes (R, PySpark).
• Multiple instance sizes. You can choose from general-purpose instance types (t2, t3, m4, m5), compute-optimized (r4, r5), or GPU-backed instances (p2, p3) depending on your workload.
• Elastic Inference. For GPU acceleration without the full cost of a p2/p3 instance, you can attach an Elastic Inference accelerator (eia1 type) to your notebook instance.
• Built-in security. Access is gated by AWS Console authentication by default.
• Git integration. You can link the instance to a Git repository hosted on AWS CodeCommit, GitHub, or any other provider, enabling version control for all notebook work.
• Curated examples. Every instance ships with a rich set of SageMaker example notebooks drawn from AWS’s public GitHub repository. You can import any example into your workspace with minimal effort.

Why Run a Local SageMaker Notebook Container?

Despite the advantages above, the hosted instance has limitations that a local Docker container can address:

• Cost. The hosted instance incurs EC2 charges whenever it is running. Spot instances are not available for Notebook instances, so there is no built-in way to reduce that cost. A local container runs free.
• Local data access. Because the hosted instance runs in the cloud, local datasets must be uploaded to S3 or another online store before use. A local container can mount any host directory directly using a Docker volume.
• No daily Console sign-in. The hosted instance requires AWS Console authentication and sessions time out after 12 hours. With the local container, you configure AWS credentials once on the host machine and do not need to sign in again for routine notebook work.
• Offline access. The local container is accessible without an internet connection — useful for data cleaning, feature engineering, and exploratory analysis that does not require SageMaker training or inference endpoints.
• Customization. The hosted instance supports lifecycle configurations and terminal access for customization, but this requires shell scripting knowledge and can feel constrained. A Dockerfile gives teams full control over their environment, which can then be shared and version-controlled like any other code artifact.
• Flexibility. The Docker image can be hosted centrally on a high-capacity on-premises server, distributed to individual developer machines, or used to spin up clusters of notebook servers. The deployment model is entirely up to the team.

Note: The AWS-hosted instance and the local container are not mutually exclusive. Used together — with a shared Git repository — they complement each other well, letting you alternate between cloud and local environments for the same project.

Features Replicated in the Local Container

The goal of the local container is to reproduce the most important features of the AWS-hosted Notebook instance while adding the benefits of local execution. Here is what has been replicated:

Jupyter Notebook and JupyterLab

The container is based on Jupyter’s official Docker images with modifications to align with SageMaker’s defaults:

• The default user is named ec2-user with passwordless sudo access, matching the hosted instance.
• Custom Miniconda and Conda versions can be specified at build time.
• JupyterHub is skipped (not needed for single-user local use).
• The default notebook directory is set to /home/ec2-user/SageMaker.

Multiple Kernels

Multiple kernels are created using Conda environments (conda env create), mirroring the kernel names used by the hosted instance. Examples include:

• conda_python2
• conda_python3
• conda_tensorflow_p36
• conda_mxnet_p36

The set of kernels is configurable at image build time via the CONDA_ENVS build argument, so a given image can include one kernel or many. Additional kernels can be added by placing Conda environment YAML files in the base/utils/envs directory and rebuilding the image.

AWS and SageMaker SDKs

Every kernel includes both the AWS Boto3 SDK and the SageMaker Python SDK. These are essential for any Python code that interacts with AWS services, including SageMaker training jobs and model deployment.

AWS CLI

The AWS CLI is installed inside the container for shell scripts and terminal workflows that interact with AWS services such as S3.

Note: Both the AWS SDK and CLI require AWS credentials to be configured on the host machine (for example, via ~/.aws/credentials or environment variables), which are then passed into the container.

Docker CLI (Host Engine Passthrough)

Many SageMaker examples require Docker to build custom training images. Rather than running a full Docker-in-Docker setup (which is complex and carries security implications), the container installs only the Docker CLI and connects it to the host machine’s Docker Engine via a socket mount.

Include the following flag when starting the container:

-v /var/run/docker.sock:/var/run/docker.sock:ro

Windows note: Update the mount path to //var/run/docker.sock:/var/run/docker.sock:ro when running on Windows.

Git Integration in JupyterLab

Git is installed in the container, and the jupyterlab-git extension is included in JupyterLab, providing a graphical interface for common Git operations without leaving the browser.

Conda Tab

Mirroring the hosted instance, the local container includes a Conda tab for browsing and managing Conda environments.

Recommendation: Rather than making ad-hoc changes through the Conda tab, update the corresponding YAML files in base/utils/envs and rebuild the Docker image. This keeps environment changes reproducible and shareable with the rest of your team.

SageMaker Examples Tab

AWS-provided SageMaker example notebooks are bundled in the Docker image, along with the same two-click copy workflow found in the hosted instance. This lets you pick any example and start experimenting immediately. (Third-party examples such as those from fast.ai and PyTorch were not included in the initial version but can be added.)

Known Gaps: Features Not Yet Replicated

The local container does not yet replicate every feature of the hosted instance. The following are known gaps:

GPU Support

The container currently targets CPU workloads only. If you need local GPU-accelerated training or inference, you must use the AWS-hosted instance or a separately configured GPU-enabled Docker setup. Note that if you submit SageMaker training jobs to GPU-backed cloud instances from within the local container, you do not need local GPU support for that workflow.

Non-Python Kernels

Additional Python-based kernels can be added with a new Conda environment YAML file. However, R and PySpark runtimes require more substantial work and were not supported in the initial version.

SageMaker Local Mode

The AWS-hosted Notebook instance supports SageMaker’s local mode, which runs training and inference containers directly on the notebook server. This feature was not configured in the initial local container release; network configuration work is needed to support it.

Automated Kernel Updates

When AWS updates the SageMaker Notebook instance (for example, bumping framework versions), the kernel Conda environment files in the local container must be updated manually. A potential future improvement would be to automate this using CloudWatch Events and AWS Lambda to detect SageMaker version changes and trigger a rebuild.

Pre-installed Python Libraries

To keep image sizes manageable, many Python libraries available in the hosted instance are not pre-installed in the local container kernels. Teams with specific library requirements should add them to a custom Conda environment YAML file and rebuild the image.

Additional Tooling

Tools such as nbdime (Jupyter notebook diff and merge) and plotlywidget (interactive graphing for Python) were identified as candidates for future inclusion.

Getting Started

To run the local SageMaker Notebook container, you need Docker installed on your machine. The general approach is:

1. Clone or build the Docker image that replicates the SageMaker Notebook environment, specifying your desired kernels via the CONDA_ENVS build argument.
2. Configure AWS credentials on your host machine (for example, via aws configure or by placing credentials in ~/.aws/).
3. Run the container with volume mounts for your working directory, the Docker socket, and your AWS credentials directory. For example:

   docker run -p 8888:8888 \
     -v $(pwd)/notebooks:/home/ec2-user/SageMaker \
     -v ~/.aws:/home/ec2-user/.aws:ro \
     -v /var/run/docker.sock:/var/run/docker.sock:ro \
     your-sagemaker-notebook-image

4. Open JupyterLab at http://localhost:8888 in your browser.

Check the source repository for the full Dockerfile, environment YAML files, and any additional run scripts specific to the implementation described in this article.

Summary

The Amazon SageMaker Notebook instance is a powerful, convenient starting point for working with the AWS ML platform. A local Docker container that replicates its core environment extends that convenience to offline work, reduces costs for development and exploration tasks, and gives teams the customization and flexibility that a managed cloud service cannot easily provide.

The two approaches work best together: use the local container for iterative development, data exploration, and cost-sensitive workflows, and switch to the hosted instance when you need GPU-backed compute, Elastic Inference, or the full library of pre-installed kernels. With Git integration keeping both environments in sync, the transition between them can be nearly seamless.

AWS also provides separate Docker containers for SageMaker training and deployment, which complement this notebook container as part of a fully containerized ML development workflow.

Overview

AT&T and Dell Technologies announced a collaboration to advance several open source projects focused on container orchestration and cloud-native infrastructure. The partnership centers on reducing friction in deploying and managing containerized workloads at scale — both on virtual machines and, increasingly, on bare-metal servers.

Key Open Source Projects in Scope

The collaboration targets three specific open source initiatives:

• AirShip — A management framework that combines OpenStack and Kubernetes to provide declarative, automated cloud provisioning and lifecycle management for containerized applications. AT&T originally launched the project, and both companies committed to accelerating its next major release.
• Metal3-io — A project focused on simplifying the provisioning of Kubernetes clusters directly on bare-metal hardware, removing the dependency on a hypervisor layer.
• OpenStack Ironic — The OpenStack service for bare-metal provisioning. Both companies committed contributions to improve the process of deploying OpenStack directly on physical servers.

Both companies also pledged contributions to the Kubernetes Cluster API, which provides a declarative API for cluster lifecycle management and is central to integrating Kubernetes with infrastructure providers such as OpenStack and bare-metal environments.

The Case for Bare-Metal Kubernetes

Eric Vallone, Director of Service Provider Solutions at Dell Technologies, stated that Dell is committed to enabling joint deployments of OpenStack and Kubernetes — whether on virtual machines or bare-metal servers. At the time of the announcement, virtual machine-based deployments were the dominant pattern for both platforms.

However, running Kubernetes directly on bare-metal offers meaningful advantages for certain workloads:

• Reduced overhead — Eliminating the hypervisor layer removes the performance and resource cost associated with running workloads inside virtual machines.
• Heterogeneous hardware support — Bare-metal Kubernetes clusters can more readily incorporate specialized processors such as GPUs and FPGAs, which are increasingly important for AI, ML, and network processing workloads.
• Tighter hardware utilization — Containerized workloads on bare metal can take full advantage of physical server resources without the abstraction tax of a guest OS and hypervisor.

Vallone acknowledged that this trajectory has implications for VMware — a Dell Technologies subsidiary — whose core business is built around hypervisor-based virtualization. Dell’s apparent bet is that VMware can evolve its portfolio to serve as a management layer bridging legacy virtualized environments and modern cloud-native, Kubernetes-based infrastructure.

AT&T’s 5G Containerization Strategy

AT&T’s motivation for the collaboration is rooted in its 5G network transformation. The carrier has publicly committed to replacing proprietary network infrastructure with open source software running on industry-standard hardware. Containers are central to that strategy: deploying 5G network functions as containerized workloads enables AT&T to build, update, and scale services with the agility that software-defined networking demands.

Beyond internal network functions, AT&T has signaled an intent to cultivate a third-party developer ecosystem — allowing external developers to build and deploy containerized applications on AT&T-managed platforms.

To support this infrastructure shift, AT&T will deploy a mix of Dell-branded and white-box servers in place of the proprietary infrastructure used for 3G and 4G network delivery, according to Vallone. This positions Dell to build expertise in carrier-grade, cloud-native deployments that it can then translate into commercial offerings for enterprise customers undergoing similar transformations.

Broader Industry Implications

The AT&T–Dell partnership reflects a wider industry trend: major carriers and infrastructure vendors are redirecting significant engineering resources toward cloud-native computing frameworks. As both AT&T and Dell face competitive pressure in their respective markets, their investment in open source container infrastructure is likely to accelerate adoption across the broader telco and enterprise IT sectors.

Projects like AirShip, Metal3-io, and the Kubernetes Cluster API benefit directly from this kind of large-scale industrial participation — contributions from organizations operating at carrier scale tend to surface integration requirements and edge cases that smaller contributors may not encounter.

Summary

What Is Container Orchestration?

Container orchestration refers to the automated management of containerised applications across clusters of hosts. It covers scheduling, scaling, networking, load balancing, health monitoring, and rolling updates. Kubernetes is the dominant open-source platform, but the broader ecosystem includes proprietary and hybrid offerings from major cloud providers and independent software vendors.

Key capabilities provided by orchestration platforms include:

• Automated scheduling: Placing container workloads on appropriate nodes based on available resources and defined constraints.
• Self-healing: Restarting failed containers, replacing unhealthy nodes, and rescheduling workloads automatically.
• Horizontal scaling: Adding or removing container instances in response to load or defined policies.
• Service discovery and load balancing: Routing traffic to containers without requiring manual configuration.
• Rolling updates and rollbacks: Deploying new versions with zero or minimal downtime and reverting if errors are detected.

Major Vendors in the Southeast Asia Container Orchestration Market

The Southeast Asia market features both global cloud hyperscalers and specialist container platform vendors. The following companies were identified as significant participants in the regional market:

• AWS – Offers Amazon Elastic Kubernetes Service (EKS) and Amazon Elastic Container Service (ECS), with a strong infrastructure presence across the region including data centres in Singapore.
• Google – Creator of Kubernetes and provider of Google Kubernetes Engine (GKE), with a Singapore cloud region serving Southeast Asian customers.
• Microsoft – Provides Azure Kubernetes Service (AKS) and broader hybrid integration through Azure Arc.
• Docker – The originator of the modern container format; Docker Enterprise (now Mirantis Kubernetes Engine) offers enterprise-grade orchestration.
• Mesosphere (D2iQ) – Known for DC/OS and Konvoy, targeting large-scale, multi-cloud deployments.
• Rancher Labs (acquired by SUSE) – Provides the Rancher platform for managing multiple Kubernetes clusters across on-premises and cloud environments, popular in enterprise deployments.
• SUSE – Offers enterprise Linux and, following its Rancher Labs acquisition, a comprehensive Kubernetes management portfolio.
• Red Hat – Provides OpenShift, a commercially supported Kubernetes distribution with integrated developer and operations tooling.
• Cisco – Integrates container orchestration with its networking and data centre portfolio through offerings such as Cisco Container Platform.
• Oracle – Provides Oracle Container Engine for Kubernetes (OKE) as part of Oracle Cloud Infrastructure.
• Ericsson – Targets telco-grade container deployments, particularly relevant to 5G network function virtualisation initiatives in the region.
• Pivotal Software (VMware Tanzu) – Offers a developer-focused Kubernetes platform; subsequently integrated into VMware Tanzu.
• Cloudify – An open-source orchestration platform supporting hybrid cloud and network function virtualisation use cases.
• Heroku – A platform-as-a-service (PaaS) that abstracts container management for application developers.

Geographic Segments: Southeast Asian Countries

The Southeast Asia container orchestration market is typically analysed across the following countries, each with distinct infrastructure maturity, regulatory environment, and cloud adoption rates:

• Singapore – The most mature cloud market in the region, home to data centre hubs for AWS, Google, Microsoft, and others. Regulatory clarity and high enterprise IT spending make it the leading adopter.
• Indonesia – The largest economy in the region by population; rapid growth in fintech, e-commerce, and logistics is driving container adoption at scale.
• Malaysia – A growing technology sector supported by government digital economy initiatives and increasing hyperscaler investment.
• Thailand – A manufacturing and services economy investing in cloud infrastructure as part of Thailand 4.0 digital policy.
• Vietnam – A fast-growing technology and outsourcing hub with increasing demand for scalable application infrastructure.
• Philippines – Strong BPO sector and growing domestic technology industry driving demand for cloud-native platforms.

Key Drivers of Container Orchestration Adoption in the Region

Several structural forces are accelerating container orchestration adoption across Southeast Asia:

• Microservices migration: Organisations decomposing monolithic applications into microservices require orchestration to manage the resulting complexity.
• Multi-cloud strategy: Enterprises are avoiding single-vendor lock-in by running workloads across AWS, GCP, and Azure, requiring a consistent orchestration layer.
• DevOps and CI/CD adoption: Containers and orchestration platforms are central to automated build, test, and deployment pipelines.
• 5G and edge computing: Telcos deploying virtualised network functions (VNFs) and multi-access edge computing (MEC) depend on lightweight container orchestration.
• Cost optimisation: Containers improve server utilisation compared to virtual machines, making orchestration financially attractive in a region sensitive to infrastructure costs.

Competitive and Analytical Dimensions to Watch

When evaluating the Southeast Asia container orchestration market, analysts and practitioners typically examine several dimensions:

• Industry chain analysis: Understanding the value chain from infrastructure providers through platform vendors to system integrators and managed service providers.
• Porter’s Five Forces: Threat of substitution (serverless, PaaS), bargaining power of large cloud buyers, and intensity of rivalry among Kubernetes-based platforms.
• Market segmentation: By deployment model (public cloud, private cloud, hybrid), by organisation size, and by vertical (financial services, telco, e-commerce, healthcare).
• Vendor consolidation: Acquisitions such as SUSE acquiring Rancher Labs and VMware absorbing Pivotal illustrate a consolidating vendor landscape where large enterprises are absorbing specialist players.
• Open-source vs. commercial: The dominance of open-source Kubernetes creates pricing pressure on commercial distributions, shifting vendor competition toward support, tooling, and managed services.

Summary

The Southeast Asia container orchestration market in 2019 represented a rapidly expanding segment driven by cloud-native adoption, microservices architecture, and regional digital economy growth. AWS, Google, and Microsoft held strong positions through managed Kubernetes services, while specialist vendors such as Red Hat OpenShift, Rancher Labs, and Mesosphere competed on enterprise features, multi-cloud support, and vertical-specific capabilities. Singapore leads regional adoption, but Indonesia, Malaysia, Vietnam, Thailand, and the Philippines are all significant growth markets. DevOps teams evaluating platforms should assess managed service maturity, regional data residency options, ecosystem integrations, and total cost of ownership across their target countries.

Note: The original market sizing figures (revenue in USD millions and CAGR percentages) cited in the source report were not disclosed in the publicly available summary. Specific figures should be sourced directly from the originating market research publication.

What Is Container as a Service (CaaS)?

CaaS is a cloud delivery model that abstracts container orchestration infrastructure — typically built on technologies such as Kubernetes or Docker Swarm — and exposes it as a managed service. Unlike Infrastructure as a Service (IaaS), where teams provision and manage virtual machines, CaaS lets developers push container images and define scaling rules while the provider handles node provisioning, networking, health checks, and upgrades.

CaaS sits between IaaS and Platform as a Service (PaaS) in the cloud stack. It gives teams more control than a fully opinionated PaaS while removing the operational burden of self-managing a Kubernetes cluster at scale.

Core Benefits Driving CaaS Adoption

• Reduced operational overhead: Managed control planes, automated upgrades, and built-in monitoring reduce the Kubernetes expertise required on each engineering team.
• Portability: Container images are environment-agnostic, making it easier to move workloads between on-premises infrastructure and public clouds.
• Faster deployment cycles: Immutable container images and declarative configuration support CI/CD pipelines and GitOps workflows.
• Resource efficiency: Containers share the host OS kernel, achieving higher workload density than equivalent VM-based deployments.
• Scalability: Horizontal pod autoscaling and cluster autoscaling allow workloads to respond to traffic spikes without manual intervention.

Major CaaS Providers and Platforms

The CaaS market includes hyperscale public cloud providers, enterprise software vendors, and specialist container platform companies. Key players include:

• Amazon Web Services (AWS): Offers Amazon Elastic Kubernetes Service (EKS) and Amazon Elastic Container Service (ECS), along with AWS Fargate for serverless container execution.
• Microsoft Azure: Azure Kubernetes Service (AKS) provides managed Kubernetes with deep integration into Azure Active Directory, Azure Monitor, and Azure DevOps.
• Google Cloud: Google Kubernetes Engine (GKE) is widely regarded as the most mature managed Kubernetes offering, given Google’s role in originating the Kubernetes project.
• VMware: VMware Tanzu provides enterprise Kubernetes across on-premises vSphere environments and public clouds, targeting organizations with existing VMware infrastructure.
• Cisco: Cisco’s container networking and AppDynamics observability tooling integrate with Kubernetes environments, and the company has invested in hybrid cloud container management capabilities.
• IBM: IBM Cloud Kubernetes Service and Red Hat OpenShift (following IBM’s acquisition of Red Hat) are significant offerings in the enterprise CaaS space.
• Docker Inc: While Docker’s primary contribution is the container runtime and image format that underpins the entire ecosystem, Docker also offers Docker Hub and Docker Business for team-level container management.
• Mesosphere (now D2iQ): Provides enterprise Kubernetes management tooling focused on day-two operations such as upgrades, multi-cluster management, and policy enforcement.
• HPE: HPE Ezmeral Container Platform (now HPE Greenlake for Containers) targets enterprise on-premises and hybrid deployments.

Smaller and specialist providers such as Giant Swarm, ContainerShip, Joyent, CoreOS (now part of Red Hat), SaltStack (now part of VMware), DH2i, and Kyup have also contributed to the ecosystem, particularly in managed hosting and container networking niches.

Key Industry Verticals Adopting CaaS

CaaS adoption is not uniform across industries. The following verticals have been consistent early adopters:

• Banking, Financial Services, and Insurance (BFSI): Strict regulatory requirements drive interest in reproducible, auditable deployments. Containers help BFSI organizations standardize environments and enforce security policies via admission controllers and image signing.
• Telecommunications: Network function virtualization (NFV) and the move toward cloud-native network functions (CNFs) make telcos a significant CaaS consumer, particularly for latency-sensitive edge workloads.
• Retail and e-commerce: Elastic scaling during peak demand periods (such as holiday sales events) is a primary driver. Containers allow retailers to scale microservices independently rather than scaling monolithic application tiers.
• Manufacturing: Industrial IoT edge deployments increasingly use lightweight container runtimes to run inference workloads and data-processing pipelines close to the factory floor.
• IT and Technology: Software-as-a-service vendors and internal platform engineering teams are the heaviest CaaS consumers, using managed Kubernetes to underpin multi-tenant product infrastructure.

CaaS Market Segmentation: What It Means for Platform Teams

Market analysts typically segment the CaaS market along two dimensions: deployment type and end-user application.

On the deployment side, the relevant distinctions for engineering teams are:

• Public cloud CaaS: Fully managed, consumption-billed services such as EKS, AKS, and GKE. Fastest time to productivity but limited control over the control plane.
• Private/on-premises CaaS: Platforms such as OpenShift and Tanzu deployed on owned infrastructure. Necessary when data residency, latency, or regulatory constraints prevent public cloud use.
• Hybrid and multi-cloud CaaS: Increasingly the default for large enterprises, using tools such as Anthos, Azure Arc, or Rancher to provide a consistent management layer across clusters running in different environments.

On the application side, CaaS is most commonly used to run workloads associated with microservices architectures — APIs, event-driven processing pipelines, batch jobs, and internal developer platforms — rather than legacy monolithic applications, which typically require re-architecture before they can take full advantage of container orchestration.

Competitive Dynamics: What Differentiates CaaS Platforms

For DevOps engineers evaluating CaaS platforms, the differentiating factors beyond raw Kubernetes conformance include:

• Control plane SLA and upgrade automation: Hyperscalers typically offer 99.9%+ uptime SLAs on the managed control plane and handle Kubernetes version upgrades with configurable maintenance windows.
• Networking and CNI integration: The choice of Container Network Interface (CNI) plugin and the depth of integration with the provider’s load balancing, firewall, and DNS services vary significantly across platforms.
• Security and compliance tooling: Features such as built-in image vulnerability scanning, pod security admission, secrets management integration (e.g., with HashiCorp Vault or cloud-native secret stores), and audit logging differ in maturity across providers.
• Ecosystem and marketplace: The availability of curated add-ons — service meshes, observability stacks, cost management tools — via a provider marketplace reduces the integration effort for platform teams.
• Developer experience: CLI tooling, local development integration (e.g., Docker Desktop, minikube, kind), and CI/CD pipeline integrations directly affect developer adoption velocity.

Geographic Distribution of CaaS Demand

CaaS demand is global, but adoption patterns reflect regional cloud maturity and regulatory environments. North America and Western Europe have the highest concentration of enterprise Kubernetes deployments. Asia-Pacific — particularly China, Japan, India, and Southeast Asia — represents significant growth markets, driven by the expansion of domestic hyperscalers (Alibaba Cloud, Tencent Cloud, Baidu Cloud) and rapid SaaS sector growth. Data sovereignty regulations in the EU (GDPR) and emerging regulations in other regions continue to influence how multi-national organizations architect their CaaS footprints.

Key Considerations for DevOps Teams Evaluating CaaS

• Total cost of ownership: Managed control planes carry a premium over self-managed clusters. Model your expected compute, networking egress, and support costs before committing to a platform.
• Lock-in risk: While Kubernetes itself is portable, heavy use of provider-specific load balancers, ingress controllers, and storage classes can increase migration friction. Prefer open standards where possible.
• Operational maturity required: Even fully managed CaaS still requires Kubernetes expertise for workload configuration, RBAC management, resource quota tuning, and incident response.
• Support for stateful workloads: If your use case involves databases or message brokers running in containers, evaluate the maturity of the platform’s persistent volume support and storage class offerings carefully.

Summary

The CaaS market reflects the broader industry shift toward cloud-native architectures. Managed Kubernetes from hyperscalers has lowered the barrier to container adoption, while enterprise platform vendors have extended CaaS capabilities to on-premises and hybrid environments. For DevOps engineers, the practical challenge is no longer whether to adopt containers, but how to select and operate a CaaS platform that matches your organization’s compliance requirements, operational maturity, and cost constraints — and how to build the internal engineering practices to use it effectively.

Overview: Cisco and Azure Join Forces on Kubernetes

Cisco has taken a significant step toward simplifying hybrid cloud operations by integrating Microsoft Azure Kubernetes Service (AKS) into the Cisco Container Platform (CCP). The goal is to give enterprise customers a single, consistent tool for deploying and managing Kubernetes clusters both on-premises and in the Azure public cloud—without juggling separate workflows, identity systems, or policy engines.

According to Kip Compton, Cisco’s Senior Vice President of Cloud Platform and Solutions, the integration reduces manual operational overhead and shortens time-to-market for containerized application environments by surfacing common identity and control policies across both deployment targets.

What Is the Cisco Container Platform?

Cisco introduced its Kubernetes-based Container Platform in January 2018. The platform is designed to provide self-service deployment and management of Kubernetes container clusters, abstracting much of the infrastructure complexity that typically slows enterprise adoption of container orchestration. With the addition of AKS as a natively integrated managed Kubernetes target, operators can now provision and manage clusters on-premises and in Azure from a single control plane.

Key Capabilities of the Cisco–Azure Integration

• Unified cluster management: AKS is added to the list of managed Kubernetes services that natively integrate with the Cisco Container Platform, enabling consistent operations across on-premises and cloud clusters.
• Common identity and policy: Operators can apply shared control policies across both on-premises CCP clusters and AKS clusters, reducing configuration drift and security gaps.
• Reduced manual work: Automation within the platform removes repetitive provisioning steps, accelerating deployment pipelines.
• Multivendor data integration: Cisco has added support for SAP’s Data Hub, enabling large datasets hosted in public clouds (AWS, Google Cloud, Azure) or on-premises systems such as Hadoop to be integrated with enterprise applications like SAP S/4 HANA.

Planned Future Enhancements

Compton outlined several features planned for subsequent releases of the Cisco Container Platform in the context of this Azure collaboration:

• Windows container support: Future phases aim to support Microsoft Windows container workloads, potentially leveraging virtual-kubelet or Windows node pools in AKS.
• Azure Active Directory integration: Cisco plans to support Azure AD as a common identity provider for both on-premises CCP clusters and AKS clusters, giving applications a single consistent authentication environment across hybrid deployments.

Background: Why Kubernetes Matters for Hybrid Cloud

Kubernetes, originally designed at Google and now an open-source Cloud Native Computing Foundation project, has become the de facto standard for container orchestration. It allows teams to deploy containerized applications across multiple server hosts, schedule and scale containers within clusters, manage inter-container networking, and monitor container health—all through a declarative API. For enterprises running workloads across on-premises data centers and public clouds, a consistent Kubernetes management layer is operationally valuable because it reduces the learning curve and toolchain fragmentation that typically accompany hybrid deployments.

Broader Cisco–Azure Partnership

The AKS integration is part of a longer-standing relationship between Cisco and Microsoft. The Cisco Integrated System for Microsoft Azure Stack, for example, enables organizations to access Azure development tools, data repositories, and services within their own data centers, using the same APIs and user interface as the Azure public cloud.

Cisco also maintains a substantial portfolio of network and security products available through the Azure Marketplace, including:

• Cloud Services Router (CSR1000v)
• Meraki vMX
• Stealthwatch Cloud
• Adaptive Security Virtual Appliance (ASAv)
• Next-Generation Firewall (NGFWv)

Cisco’s Wider Multicloud Kubernetes Strategy

The Azure collaboration fits into a broader Cisco push to give enterprises consistent Kubernetes management across all major public cloud providers.

Cisco and AWS

Cisco and Amazon Web Services jointly offer the Cisco Hybrid Solution for Kubernetes on AWS. This package combines Cisco Container Platform with Amazon Elastic Kubernetes Service (EKS), enabling customers to provision clusters on-premises and on EKS using integrated Cisco, AWS, and open-source technologies. The aim is to reduce the complexity of managing secure, consistent Kubernetes deployments that span private data centers and AWS.

Cisco has also released Cisco Cloud ACI for AWS, an extension of its Application Centric Infrastructure SDN software that lets users configure inter-site connectivity, define network policies, and monitor the health of network infrastructure across hybrid AWS environments from a single interface.

Cisco and Google Cloud

Cisco and Google have collaborated on hybrid cloud since at least October 2017. The Cisco Hybrid Cloud Platform for Google Cloud became generally available in September 2018. It combines Google Cloud-managed Kubernetes with Cisco networking and security technology, and incorporates Istio-based service mesh monitoring—giving enterprise teams a consistent, secure runtime for applications across on-premises data centers and Google Cloud.

What This Means for DevOps and Platform Engineering Teams

For teams already invested in Cisco networking infrastructure, the Container Platform integrations with AKS, EKS, and Google Kubernetes Engine offer a potential path to hybrid Kubernetes without abandoning existing security and networking tooling. Key practical considerations include:

• Policy consistency: Applying the same network and security policies across on-premises and cloud clusters reduces audit complexity and human error.
• Identity unification: Integrating Azure AD or other identity providers across both environments eliminates the need to maintain parallel RBAC configurations.
• Marketplace availability: Cisco security appliances available natively in the Azure Marketplace simplify licensing and deployment for teams standardizing on Azure.
• Vendor lock-in trade-offs: Centralized management through a single vendor platform offers operational simplicity but introduces dependency on Cisco’s roadmap and support lifecycle.

As enterprises increasingly run workloads across multiple clouds and on-premises environments, vendor-integrated hybrid Kubernetes management platforms like CCP represent one approach to reducing operational complexity—though open-source alternatives such as Rancher, OpenShift, and Anthos address similar problems with different trade-offs.

What Is Container Monitoring?

Container monitoring is the practice of continuously tracking the performance, health, and behavior of containerized applications and the infrastructure they run on. Unlike traditional application monitoring, container environments are highly dynamic — containers spin up and tear down in seconds, workloads shift across hosts, and dozens of microservices may communicate across a single user request.

Effective container monitoring typically covers:

• Container-level metrics — CPU usage, memory consumption, network I/O, and disk activity per container.
• Orchestration-layer visibility — Pod, node, and cluster health when running Kubernetes or similar schedulers.
• Application performance monitoring (APM) — Distributed tracing, request latency, and error rates across services.
• Log aggregation — Centralizing stdout/stderr streams from ephemeral containers for troubleshooting.
• Security posture — Detecting anomalous runtime behavior, unexpected network connections, or privilege escalations.

Key Market Drivers

Several converging trends have pushed container monitoring from a niche concern to a mainstream requirement:

• Rapid adoption of Docker and Kubernetes — As container orchestration became the default deployment model for cloud-native applications, the need for purpose-built observability tools grew alongside it.
• Microservices proliferation — Breaking monoliths into many small services multiplies the number of components to observe and correlate.
• Ephemeral workload lifetimes — Short-lived containers make agent-based monitoring challenging and push vendors toward lightweight, auto-discovery approaches.
• Shift to hybrid and multi-cloud — Organizations running containers across multiple cloud providers need unified visibility, not siloed dashboards.
• Compliance and SLA obligations — Regulated industries such as finance and healthcare require audit trails and performance evidence even for containerized workloads.

How the Market Is Segmented

The container monitoring market can be analyzed across several dimensions:

By Component

Offerings divide broadly into solutions (software platforms and agents) and services. Services break down further into:

• Professional services — Consulting and integration, training and development, and ongoing maintenance and support.
• Managed services — Fully outsourced monitoring operations, popular with teams that lack dedicated SRE capacity.

Training and development services carry particular growth potential because containerized architectures require engineers to understand how application components are wired together, how networking works between pods, and how to interpret distributed traces — skills that differ meaningfully from traditional ops.

By Operating System

Linux dominates the container host market. Docker’s roots are Linux-native, and Kubernetes nodes are overwhelmingly Linux-based. Windows Server containers have grown in relevance for .NET workloads, but the tooling ecosystem remains smaller.

By Deployment Model

Cloud-based (SaaS) monitoring is the dominant choice for most teams. Benefits include rapid onboarding, elastic data ingestion, no infrastructure to operate, and automatic feature updates. On-premises deployments remain relevant in air-gapped environments or where data residency requirements prohibit external data transfer.

By Organization Size

Both large enterprises and SMBs consume container monitoring tools, but their needs differ. Enterprises often require fine-grained RBAC, SSO integrations, and on-premises options. Smaller teams prioritize ease of setup, transparent pricing, and generous free tiers.

By Industry Vertical

Container monitoring is relevant across verticals. High-adoption sectors include:

• IT and Telecom — Early adopters of containerization at scale.
• BFSI (Banking, Financial Services, and Insurance) — Driven by uptime requirements and regulatory pressure.
• Healthcare — Increasing adoption of cloud-native applications with HIPAA compliance needs.
• Government — Growing container usage in public-sector digital transformation initiatives.
• Transportation and Logistics — Real-time data pipelines benefit from containerized microservices with strong observability.

Notable Vendors in the Container Monitoring Space

The container monitoring ecosystem includes both broad observability platforms and specialist tools. Key players frequently cited in this market include:

• Datadog — A SaaS observability platform with deep Kubernetes and container integrations, distributed tracing, and log management.
• Dynatrace — Known for AI-assisted root cause analysis and full-stack observability including containers, hosts, and user sessions.
• Splunk — Strong in log analytics and SIEM; extended into container and infrastructure monitoring via acquisitions.
• AppDynamics (Cisco) — APM-focused platform with container and Kubernetes visibility features aimed at enterprise environments.
• Sysdig — Built on open-source Falco and focused on cloud-native security and monitoring, with strong Kubernetes support.
• BMC Software — Enterprise IT management vendor with container monitoring capabilities within broader AIOps offerings.
• SignalFx (Splunk) — Originally an infrastructure metrics platform built for ephemeral, cloud-native environments; acquired by Splunk in 2019.
• Wavefront (VMware Aria Operations for Applications) — Time-series analytics platform with Kubernetes and container metrics support.
• CoScale — A container-native monitoring startup that was acquired by Datadog.
• Broadcom (formerly CA Technologies) — Offers enterprise monitoring and APM tools that have extended to containerized workloads.

The landscape has consolidated significantly since 2019 through acquisitions, and the open-source ecosystem (Prometheus, Grafana, OpenTelemetry) has matured as a credible alternative to commercial platforms.

Open-Source Alternatives Worth Knowing

Many teams build their container monitoring stack around open-source components before evaluating commercial tools:

• Prometheus — The de-facto metrics collection and alerting standard for Kubernetes environments, with a large exporter ecosystem.
• Grafana — Visualization layer for Prometheus and many other data sources; used widely alongside commercial backends.
• OpenTelemetry — Vendor-neutral instrumentation standard for traces, metrics, and logs, increasingly adopted as the instrumentation layer of choice.
• Jaeger / Zipkin — Distributed tracing systems frequently deployed alongside Prometheus for end-to-end request visibility.
• Fluentd / Fluent Bit — Log collection agents optimized for containerized environments.

Choosing a Container Monitoring Strategy

When evaluating container monitoring tooling, consider these factors:

1. Auto-discovery — Can the tool automatically detect new containers and services without manual configuration?
2. Kubernetes-native support — Does it surface pod, namespace, and cluster-level metrics natively?
3. Cardinality handling — Container environments produce high-cardinality metrics. Verify the platform’s pricing and performance at scale.
4. Unified telemetry — Can it correlate metrics, logs, and traces in a single interface to speed up incident response?
5. Data residency and compliance — Does your industry or region require on-premises deployment or specific data handling guarantees?
6. Total cost of ownership — Include ingestion costs, retention, and the engineering time required to maintain the stack.

Summary

Container monitoring has evolved from an optional operational nicety into a foundational requirement for any team running containerized workloads at scale. The market spans commercial platforms, managed services, and a mature open-source ecosystem. Regardless of the tooling chosen, teams that invest in comprehensive container observability — covering metrics, logs, and traces — are better positioned to maintain performance, reduce mean time to recovery, and meet compliance obligations as their container footprints grow.

What Is Container as a Service (CaaS)?

CaaS is a cloud delivery model that provides container engines, orchestration tooling (most commonly Kubernetes), and the supporting infrastructure as a managed service. Consumers interact with APIs and dashboards to define workloads; the provider handles node provisioning, patching, scaling control planes, and availability.

CaaS sits between Infrastructure as a Service (IaaS) — where teams manage their own VMs and install container runtimes manually — and Platform as a Service (PaaS), which typically abstracts away the container model entirely. CaaS gives developers the portability and reproducibility of containers while offloading operational overhead to the platform.

Why CaaS Adoption Is Accelerating

• Microservices architectures: Breaking monolithic applications into independently deployable services is far easier when each service runs in its own container with well-defined resource limits.
• Developer velocity: Consistent environments from laptop to production reduce “works on my machine” failures and shorten release cycles.
• Cost efficiency: Container bin-packing allows higher compute utilization compared with one-service-per-VM deployments.
• Hybrid and multi-cloud strategies: Container images are portable across cloud providers, reducing vendor lock-in at the application layer.
• DevOps and CI/CD maturity: Containers integrate naturally into automated pipelines, enabling blue/green deployments, canary releases, and rapid rollback.

Major Vendors in the CaaS Market

The CaaS space is competitive, with hyperscale cloud providers, established enterprise software vendors, and specialist platform companies all offering differentiated products.

Hyperscale Cloud Providers

• Amazon Web Services (AWS): Offers Amazon ECS (Elastic Container Service) and Amazon EKS (Elastic Kubernetes Service), along with AWS Fargate for serverless container execution.
• Google: Google Kubernetes Engine (GKE) is widely regarded as one of the most mature managed Kubernetes offerings, given Google’s role in creating Kubernetes.
• Microsoft: Azure Kubernetes Service (AKS) and Azure Container Instances provide flexible options from fully managed clusters to on-demand single containers.
• IBM: IBM Cloud Kubernetes Service and Red Hat OpenShift on IBM Cloud serve enterprise customers requiring hybrid-cloud and compliance-focused deployments.

Enterprise Software and Networking Vendors

• VMware: Tanzu portfolio brings Kubernetes management to vSphere-based on-premises infrastructure, bridging traditional virtualization and modern container workloads.
• Cisco: Intersight and AppDynamics integrations extend Cisco’s data-center footprint into container observability and workload management.
• HPE: HPE Ezmeral Container Platform (formerly BlueData) targets AI/ML and data analytics workloads running in containers on-premises or in hybrid environments.

Specialist and Open-Source-Focused Vendors

• Docker Inc: The company that popularized the container image format. Docker Desktop and Docker Hub remain central to developer workflows even as orchestration moved toward Kubernetes.
• Mesosphere (now D2iQ): Built on Apache Mesos, D2iQ’s Konvoy and Kommander platforms target enterprise Kubernetes management at scale.
• Giant Swarm: Provides a managed Kubernetes service designed for enterprises that need dedicated, single-tenant clusters with strong SLAs.
• CoreOS (acquired by Red Hat, now part of IBM): Container Linux and related projects influenced the design of modern container-optimized operating systems.
• Joyent (acquired by Samsung): Known for Triton, a container-native infrastructure platform built on SmartOS.
• SaltStack (acquired by VMware): Configuration management tooling that complements container infrastructure automation.

Key Industries Adopting CaaS

CaaS adoption is not uniform. Certain verticals are investing more aggressively based on their need for scalability, rapid iteration, and regulatory-compliant portability.

Information Technology and Telecommunications

Software companies and telecoms are among the earliest and heaviest adopters. Containers help telcos modernize network functions (NFV) and run 5G workloads at the network edge, while software vendors use them to standardize multi-tenant SaaS delivery.

Banking, Financial Services, and Insurance (BFSI)

BFSI organizations face strict compliance and audit requirements, but also need to release features rapidly to compete with fintech challengers. CaaS enables immutable infrastructure patterns that satisfy auditors while supporting continuous delivery pipelines.

Retail and E-Commerce

Retailers must handle extreme traffic spikes (seasonal sales, promotions) without over-provisioning year-round. Container autoscaling on managed platforms makes elastic, cost-efficient scaling achievable without significant platform engineering investment.

CaaS vs. Related Delivery Models

Geographic Market Distribution

CaaS adoption is a global phenomenon, though the pace varies by region:

• North America (United States, Canada, Mexico): Home to most hyperscale cloud providers and a large concentration of early-adopter technology companies. Demand is driven by software, financial services, and media sectors.
• Europe (Germany, UK, France, Russia, Turkey, and others): Enterprise adoption is strong, particularly in financial services and manufacturing. GDPR compliance requirements influence data-residency decisions and favor regional cloud deployments.
• Asia-Pacific (China, India, Japan, Australia, South Korea, Southeast Asia): Rapid digital transformation in e-commerce, fintech, and telecommunications is driving significant CaaS growth, particularly in India and Southeast Asia.
• South America (Brazil and others): Growing cloud adoption among enterprises, with Brazil leading regional demand.
• Middle East and Africa (GCC countries, Egypt): Sovereign cloud initiatives and smart-city projects are creating new CaaS demand.

Evaluating a CaaS Platform: Key Criteria

When selecting a CaaS provider, engineering and platform teams should evaluate the following:

1. Kubernetes version currency: How quickly does the provider release new Kubernetes minor versions, and how long are older versions supported?
2. Control plane SLA: Is the Kubernetes API server availability covered by an SLA, and what is the compensation model for downtime?
3. Node autoscaling: Does the platform support cluster autoscaler or Karpenter-style bin-packing to minimize idle compute cost?
4. Networking and CNI options: Which Container Network Interface plugins are supported? Can you enforce network policies for zero-trust segmentation?
5. Observability integration: Does the platform expose Prometheus metrics, support OpenTelemetry, and integrate with your existing logging pipeline?
6. Multi-cluster and hybrid support: Can workloads span on-premises and cloud clusters, or multiple cloud regions, with a unified control plane?
7. Compliance certifications: Does the provider hold SOC 2, ISO 27001, FedRAMP, or other certifications required by your industry?

Summary

The CaaS market reflects the broader industry shift toward cloud-native application architectures. Organizations across retail, financial services, and telecommunications are deploying containers at scale to improve developer velocity, reduce infrastructure costs, and increase deployment reliability. The vendor landscape is diverse — from hyperscale providers such as AWS, Google, and Microsoft to specialist platforms such as Giant Swarm and D2iQ — giving teams options to match their operational maturity and compliance requirements. As Kubernetes becomes the de facto standard for container orchestration, CaaS platforms will continue to abstract away undifferentiated infrastructure work so engineering teams can focus on delivering business value.

What Is the Application Container Market?

Application containers solve a fundamental problem in software delivery: how do you ensure that software runs reliably when moved between computing environments? That might mean moving code from a developer’s laptop to a CI test runner, from a staging environment to production, or from a bare-metal server to a virtual machine in a public or private cloud.

Containers package an application together with its runtime dependencies, libraries, and configuration into a single, portable unit. This isolation guarantees consistent behavior regardless of the underlying host infrastructure. Technologies such as Docker popularized this approach, while orchestration platforms like Kubernetes addressed the challenge of running containers at scale.

Beyond pure portability, the term “application container” also encompasses the broader ecosystem of tooling required to build, ship, secure, monitor, and orchestrate containerized workloads — all segments captured in the market research data below.

Key Players in the Application Container Market

The report identified the following vendors as significant participants in the global application container market at the time of publication:

• Cloud and infrastructure providers: Amazon Web Services (AWS), Microsoft Azure, IBM, VMware
• Container platform and orchestration vendors: Red Hat (OpenShift), Mesosphere (DC/OS), Rancher Labs, CoreOS (acquired by Red Hat), Cloud Foundry
• Networking and security specialists: Cisco, Weaveworks, Twistlock (acquired by Palo Alto Networks), Draios (Sysdig)
• Storage and data management: Nimble Storage, Portworx, BlueData
• Platform-as-a-Service and workload management: Apprenda, Apcera

The competitive landscape has shifted significantly since 2019. Several vendors listed above have since been acquired, merged, or rebranded. Kubernetes has emerged as the de facto standard for container orchestration, consolidating the market around a smaller number of managed Kubernetes services offered by major cloud providers.

Market Segmentation

The report segmented the application container market across six primary dimensions. Understanding these segments helps DevOps and platform engineering teams assess where investment and tooling decisions are most impactful.

By Platform

• Kubernetes
• Docker Swarm
• Amazon ECS (Elastic Container Service)
• Apache Mesos
• HashiCorp Nomad
• Cloud Foundry
• OpenStack Magnum
• Azure Container Service
• Internally developed tooling

By Service Type

• Consulting and professional services
• Container monitoring
• Container security
• Container data management
• Container networking
• Container orchestration
• Support and maintenance

By Deployment Model

• Cloud (public, private, hybrid)
• On-premises

By Enterprise Size

• Small and medium-sized enterprises (SMEs)
• Large enterprises

By Application Use Case

• Production workloads
• Developer collaboration and inner-loop tooling
• Application modernization (legacy-to-container migration)
• Resource optimization and content management

By Industry Vertical

• Retail and e-commerce
• Banking, financial services, and insurance (BFSI)
• Healthcare and life sciences
• Telecom and IT services
• Government and defense
• Energy and utilities
• Manufacturing
• Education, media, and entertainment

By Geography

The report covered 28 countries across North America, South America, Europe, Asia-Pacific, and the Middle East & Africa.

Market Drivers and Restraints

Several forces were identified as accelerating — or constraining — growth in the container market. These remain useful reference points for understanding enterprise adoption patterns.

Growth Drivers

• Microservices architecture adoption: Decomposing monolithic applications into independently deployable services is a natural fit for containers, as each service can be packaged, versioned, and scaled independently.
• Application modernization at scale: Enterprises migrating legacy business-critical applications to cloud-native architectures are a significant source of container platform investment.
• Demand for business agility: Faster release cycles, blue-green deployments, and environment parity across dev/test/production all lower the cost of software change — a competitive differentiator in most industries.

Restraints and Challenges

• Security risks: Container images, registries, runtime environments, and inter-service communication all introduce attack surface. Misconfigured containers and over-privileged workloads remain persistent concerns.
• Skills gap: Kubernetes and cloud-native tooling require significant expertise. The shortage of engineers with hands-on container orchestration experience continues to be a barrier for many organizations.

What This Means for DevOps Teams

The 33.2% projected CAGR signals that container technology was not a niche concern even in 2017 — it was already on a steep growth trajectory backed by enterprise spend. For DevOps engineers, the practical takeaways from this market landscape are:

• Platform consolidation is real. The long list of orchestration platforms in the segmentation data has narrowed considerably, with Kubernetes now dominant. Investments in Kubernetes expertise have compounded in value.
• Security and observability are their own markets. The segmentation of container security and monitoring as distinct service categories reflects the genuine complexity of securing and observing containerized workloads. Purpose-built tools in these areas (such as Falco, Sysdig, and Trivy) are worth evaluating separately from the orchestration layer.
• Industry vertical matters for compliance requirements. BFSI, healthcare, and government verticals face additional regulatory constraints (PCI-DSS, HIPAA, FedRAMP) that shape how containers can be deployed and what runtime security controls are mandatory.

Note: The market data cited in this article originates from a Data Bridge Market Research report published around 2019, with a base year of 2017. Figures should be treated as indicative of the market trajectory at that time rather than current valuations. Consult up-to-date analyst reports for present market sizing.

Why Containers Have Become the Deployment Standard

Containers provide a portable, platform-agnostic way to package an application’s code, configuration, and dependencies into a single runnable unit. Unlike virtual machines, containers share the host operating system kernel, which means they start in milliseconds rather than minutes. This characteristic alone makes containers ideal for modern CI/CD pipelines, where rapid iteration and frequent deployments are the norm.

The key benefits driving adoption include:

• Portability: A container image runs consistently across laptops, on-premises servers, and public cloud environments, eliminating environment-specific configuration drift.
• Resource efficiency: Because containers do not boot a full OS, they consume significantly less CPU and memory than equivalent VMs, allowing higher workload density on the same hardware.
• Elastic scalability: Orchestration platforms such as Kubernetes can spin new container instances up—or retire them—in seconds in response to demand spikes, far faster than provisioning VMs.
• Developer velocity: Packaging dependencies inside the image shortens onboarding time and reduces “works on my machine” incidents, supporting faster release cycles.

The Security Challenges Containers Introduce

The same properties that make containers fast and flexible also make them harder to secure than traditional or even virtualised infrastructure. Three distinct problem areas stand out.

1. Density and Dynamism at Scale

A single physical host in a containerised environment may run dozens or hundreds of containers simultaneously. Those containers are created and destroyed continuously by schedulers such as Kubernetes. Legacy security controls—particularly network appliances and host-based agents—were designed for environments where workloads have stable IP addresses and long lifetimes. In a container environment, a workload may exist for only a few seconds before being replaced by a fresh instance with a different identifier. Security policies that rely on static IP addresses or persistent agents cannot keep pace with this cycle.

2. An Expanded and Automated Attack Surface

Container orchestration platforms expose rich APIs that automate scheduling, networking, storage, and secrets management. While these APIs are essential to the operational model, they also represent a significant attack surface. A misconfigured Kubernetes API server, an overly permissive service account, or an insecure container registry can allow an attacker to move laterally across many workloads simultaneously. The automation that makes containers efficient also means that a single misconfiguration can propagate instantly across an entire cluster.

3. Agent Incompatibility

Traditional endpoint security relies on agents installed inside each workload. In containerised environments this approach is impractical: containers are intentionally minimal (often based on distroless or Alpine images), ephemeral, and immutable at runtime. Installing and maintaining agents inside every container image conflicts directly with the immutable infrastructure model, inflates image sizes, and creates operational overhead that offsets the efficiency gains containers provide.

Principles of Effective Container Security

Addressing these challenges requires rethinking security architecture rather than retrofitting legacy tools. Several principles guide effective approaches:

Policy Driven by Application Context, Not Network Topology

Because container IP addresses are ephemeral, security policies must be expressed in terms of application identity—labels, namespace, service name, or workload role—rather than IP ranges or port numbers. Container orchestrators already maintain this metadata; effective security tools consume it directly from the control plane (for example, the Kubernetes API) and translate it into enforcement rules automatically as workloads start and stop.

Declarative, Pre-Defined Policies

Security policies should be defined before containers are instantiated, using a declarative model that describes the intended behaviour of an application tier (for example, “the payment service may only accept inbound connections from the API gateway, and may only initiate outbound connections to the database”). When a new container matching that application’s labels comes online, the policy is applied immediately without manual intervention.

Consistent Controls Across Hybrid and Multi-Cloud Environments

Most enterprises run workloads across a combination of on-premises infrastructure, private cloud, and one or more public cloud providers. Security controls that only apply to one environment create blind spots and management complexity. An effective container security platform applies a consistent policy model regardless of where the workload is running—whether on bare metal, in a VM, in a managed Kubernetes service, or in a platform-as-a-service environment.

Stateful, Application-Aware Enforcement

Simple packet filtering is insufficient for modern application threats. Security enforcement should be stateful—tracking connection state rather than evaluating each packet in isolation—and application-aware, understanding the semantics of protocols such as HTTP, gRPC, or database wire formats. This allows policies to distinguish between legitimate API calls and anomalous or malicious traffic at the application layer.

Practical Steps to Improve Container Security Today

Regardless of which platform or tooling you choose, the following practices form a baseline that every team running containers should implement:

1. Scan images at build time. Integrate a container image scanner into your CI pipeline to catch known CVEs in base images and installed packages before they reach production.
2. Use minimal base images. Prefer distroless or Alpine-based images to reduce the attack surface. Fewer packages mean fewer vulnerabilities.
3. Enforce least-privilege at the pod level. Set securityContext fields in Kubernetes manifests to run containers as non-root, drop unnecessary Linux capabilities, and use read-only root filesystems.
4. Apply Kubernetes Network Policies. Restrict pod-to-pod traffic using NetworkPolicy resources so that workloads can only communicate with explicitly permitted peers.
5. Protect the control plane. Enable Kubernetes RBAC, restrict access to the API server, rotate credentials regularly, and audit API server logs for anomalous activity.
6. Implement runtime monitoring. Use a runtime security tool capable of detecting anomalous system calls or network connections from running containers, providing a last line of defence against zero-day exploits and misconfigurations that slip through build-time checks.
7. Manage secrets securely. Never bake secrets into container images. Use a secrets management solution—such as Kubernetes Secrets with envelope encryption, HashiCorp Vault, or a cloud-provider equivalent—and inject secrets at runtime.

Can You Have Both Agility and Security?

The answer is yes—but only if security is treated as an architectural concern from the start rather than something bolted on after deployment. The fundamental shift is moving from a perimeter-based model, where security is enforced at the edge of the network, to a workload-centric model, where every container carries its own security context and policies follow the workload wherever it runs.

When security policies are expressed in terms that orchestrators already understand—labels, namespaces, service identities—and when enforcement is automated by tools that integrate directly with the control plane, the operational overhead of securing containers becomes manageable. Teams get the rapid deployment cycles they need, and security teams gain consistent, auditable visibility across the entire environment.

Container technology is maturing quickly. The ecosystem of open-source tools (Falco for runtime security, OPA/Gatekeeper for policy enforcement, Trivy for image scanning, among others) and commercial platforms that address these challenges is growing alongside it. Teams that invest in understanding the container threat model and adopt security tooling designed for ephemeral, high-density workloads will find that agility and security reinforce each other rather than competing.

This article was updated and expanded from an original post referencing coverage from datacenternews.us (2019) and commentary from vArmour. Product and company details should be independently verified as the container security vendor landscape has changed significantly since the original publication date.

Overview

Kubernetes 1.13 was released on December 3, 2018, marking the fourth and final release of the year for the project. Following 1.10 (March 26), 1.11 (June 27), and 1.12 (September 27), version 1.13 was notable for being the shortest development cycle in Kubernetes history at that point. Despite that compressed timeline, the release team focused on graduating long-standing features to general availability (GA) and improving the overall reliability of the platform.

Aishwarya Sundar, the release lead, described the guiding philosophy: “One of the main themes that we tried to align the cycle with was around stability—focusing more on giving users a reliable and stable end-of-year refresh of capabilities, mostly focusing on graduating long-term outstanding features that have had time to mature.”

Three features reached GA in this release: kubeadm, the Container Storage Interface (CSI), and CoreDNS as the default cluster DNS provider. The release also added Topology Aware Volume Scheduling as a stable feature and promoted several capabilities to beta and alpha status.

Release Process Improvements

The 1.13 cycle introduced several non-user-facing process improvements that helped the team ship on time despite the shorter window. Sundar highlighted tighter CI/CD signal monitoring, earlier triage of breaking changes, and stricter criteria for test jobs that could block a release.

“We made a few release process improvements as well, focusing on CI/CD signals and triaging breaking changes early on in the cycle and also tightening the criteria for test jobs that block the release. All of these were non-user-facing improvements that we did in terms of the release process itself to ensure that we can land a stable, reliable release on time.”

— Aishwarya Sundar, Kubernetes 1.13 Release Lead

Storage: CSI Goes GA and Topology-Aware Scheduling Stabilizes

Container Storage Interface (CSI)

The Container Storage Interface had been under active development for nearly a year before 1.13, first appearing as a beta feature in Kubernetes 1.10. With 1.13, CSI reached general availability, providing a stable and standardized abstraction layer that allows third-party storage vendors to build out-of-tree plugins without modifying the Kubernetes core codebase.

Before CSI, storage drivers were compiled directly into the Kubernetes binary (in-tree plugins), making it difficult for vendors to iterate independently. The stable CSI API allows vendors to ship and update storage plugins as standalone components, improving the ecosystem’s overall agility and reducing the maintenance burden on the Kubernetes project itself.

Topology Aware Volume Scheduling

Also reaching stable status in 1.13, Topology Aware Volume Scheduling enables the Kubernetes scheduler to make intelligent decisions when provisioning storage volumes alongside pods. In a multi-zone cluster, for example, this feature ensures that a volume is provisioned in the same availability zone as the pod that will consume it—preventing cross-zone latency or access failures.

“So we have the scheduler which provides input as to which would be the best place to provision a volume and the pod. For example, if you have a multi-zone cluster, this means the volumes will get provisioned in an appropriate zone that can run within the pod, allowing administrators to easily deploy and scale stable workloads.”

— Aishwarya Sundar

By co-locating volumes and pods within the same topology domain, this feature directly supports high-availability and fault-tolerant deployment architectures.

kubeadm Reaches General Availability

kubeadm, the command-line tool for bootstrapping Kubernetes clusters, also graduated to GA in version 1.13. kubeadm simplifies the process of creating, configuring, and upgrading Kubernetes clusters by automating the complex bootstrapping steps that would otherwise require manual intervention.

The GA designation came after multiple release cycles of gathering user feedback, fixing bugs, and hardening the tool’s behavior. With GA status, users can rely on kubeadm’s command-line interface and behavior remaining stable across future Kubernetes releases, making it a suitable foundation for production cluster lifecycle management.

Key kubeadm capabilities include:

• Cluster bootstrap: Initializes a control plane node with sensible defaults using kubeadm init.
• Node join: Simplifies adding worker nodes to an existing cluster with kubeadm join.
• Upgrade management: Guides the user through control-plane and node upgrades with kubeadm upgrade.
• Configuration tracking: Stores cluster configuration in a ConfigMap for auditability and reproducibility.

CoreDNS Becomes the Default DNS Provider

Kubernetes 1.13 replaced kube-dns with CoreDNS as the default in-cluster DNS server. CoreDNS is a flexible, plugin-based DNS server written in Go and a CNCF project. Its plugin architecture makes it easier to extend with features such as custom DNS resolution policies, caching, health checks, and metrics—without patching core DNS functionality.

Clusters upgraded from older versions would continue to use kube-dns unless explicitly migrated, but new clusters created with kubeadm 1.13 would default to CoreDNS.

Beta Features: A Look at What’s Coming

kubectl diff

kubectl diff entered beta in 1.13. The command compares a locally declared object configuration (e.g., a YAML manifest) against the live state of the corresponding object in the cluster. This gives operators a clear, diff-style view of pending changes before applying them, reducing the risk of unintended configuration drift.

API Server Dry Run

Also promoted to beta, the API server dry run feature allows users to submit API requests that are fully validated and processed by the server-side logic—including admission webhooks—without actually persisting any changes to etcd. This moves validation responsibility from the client (kubectl) to the server, making it possible to catch errors that client-side dry runs would miss.

“The API server dry run is one of the things which will help us fix a lot of existing bugs, that are elusive today with applied commands being managed within kubectl and not with an API server.”

— Aishwarya Sundar

Alpha Features: Third-Party Device Monitoring Plugins

Kubernetes 1.13 introduced alpha support for third-party device monitoring plugins. This feature allows cluster administrators and hardware vendors to expose device-level metrics (e.g., GPU utilization, network interface counters) to the Kubernetes monitoring stack without requiring changes to the core kubelet.

“The main advantage of this feature is it will enable cluster administrators to gather more container-level metrics for devices and provide device vendors with the ability to provide device-specific metrics.”

— Aishwarya Sundar

This builds on the existing Device Plugin framework introduced in earlier releases and moves the ecosystem toward a more extensible hardware management model.

Summary of Key Changes in Kubernetes 1.13

Background: Kubernetes and the CNCF

Kubernetes is a container orchestration platform originally developed by Google and donated to the Cloud Native Computing Foundation (CNCF) in July 2015. Since then it has become the de facto standard for running containerized workloads at scale. The 1.13 release demonstrated the project’s increasing focus on production readiness—graduating long-standing beta features and improving the release engineering process rather than simply adding new experimental functionality.