Containers and Kubernetes

Containers and Kubernetes are how most modern apps are packaged and run on servers. A container is a packaged piece of an application, together with everything it needs to run: the libraries it uses, its settings and the small parts of an operating system it depends on. Kubernetes is the open-source system that runs containers across many servers. It decides which server runs each container, restarts any container that fails and adds more copies when demand rises. Kubernetes was first built at Google and released free in 2014. It is often written as K8s.

Here is how it works in general. A developer packs the application into a container image, a single file that holds the app and everything it needs. The image is stored in a registry, which is a store for images. Because the image carries its own libraries and settings, it runs the same way on the developer's laptop, on a test server and on the live servers. The developer then tells Kubernetes what is wanted, for example, keep five copies of this container running. Kubernetes places the copies on servers that have room. If a server crashes, Kubernetes starts the lost copies on other servers. If traffic rises, it can add copies, and it removes them when traffic falls.

A modern app is often split into many small services, such as login, search and payments, each running in its own containers. So a team can update one service without stopping the others.

Take, for example, a developer setting up a project on a new laptop. With Docker, she runs the whole app, with its database, in containers, instead of installing each piece by hand.

Consider a shopping app during a festival sale, when the number of visitors rises tenfold in an hour. A Kubernetes platform adds copies of the checkout service, and removes them after the sale.

Say a company wants to answer its customers' questions with an AI model. A model deployment platform packs the model into containers and runs them on Kubernetes, on servers with GPUs.

Containers bring their own security tasks. An image can carry an old library with a known flaw, which container image scanning checks for before release. Once the containers are running, cloud workload protection watches what they do.

How is a container different from a virtual machine? A virtual machine is a whole pretend computer with its own operating system, and it can take a minute or more to start. Containers on one server share that server's operating system, so they are much smaller and start in seconds. Many companies run their containers inside virtual machines in the cloud.