Containers & Orchestration

The platform chooses the port, passes it in as an environment variable, and then connects to the container's IP on that port. An app that hardcodes a different port, or listens only on 127.0.0.1, is unreachable from outside its own network namespace.

Pull the new image while the old container still serves, then stop it, remove it and run a new container on the new tag. Pin an immutable tag, and keep the previous image for rollback.

--push is shorthand for --output type=registry: buildx streams the finished layers from the builder straight to the registry. On a docker-container builder the image never enters the local image store, so a separate docker push would find nothing to push.

A bind mount maps a host directory onto a path inside the running container, so an edit on the host is visible to the process instantly. Source baked in with COPY changes only when you rebuild the image.

A non-zero exit from any RUN command aborts docker build immediately: no layer is committed for that step and no image is tagged. Running the test suite in a RUN step is what turns a failing test into a failing build.

docker compose run starts a new one-off container from a service's definition; docker compose exec runs a command inside that service's already running container. Use run for migrations and scripts, exec to inspect a live service.

The project .env file only feeds ${VAR} substitution while Compose parses compose.yaml. A service's env_file and environment attributes set variables inside its container; nothing in .env reaches a container unless one of them passes it on.

Compose runs a multi-container stack from one declarative YAML file instead of many long docker run commands. The main top-level keys are services (the containers), networks, and volumes. docker compose up creates everything; down removes it.

The code is baked into the image, and docker compose restart only restarts the existing container from that old image. Rebuild and recreate with docker compose up -d --build api; a plain up skips the build because a local image already exists.

${VAR:-default} uses the default when VAR is unset or empty, ${VAR-default} only when it is unset, and ${VAR:?err} makes Compose stop with err when VAR is unset or empty. Use defaults for tunables and :? for values that must be supplied.

The app must read configuration from environment variables or mounted files, log to stdout and stderr, expose a readiness signal that reflects real ability to serve, shut down cleanly on SIGTERM, and size itself from its container limits.

A golden-path template is a platform-maintained, pre-approved way to deploy a service: developers fill in a few values and the template produces the Deployment, Service, probes and resources, so every team gets safe defaults without writing raw Kubernetes manifests.

Labels are short identifying key/value pairs that selectors match, so Services, Deployments and kubectl -l find objects by them. Annotations carry non-identifying data of any shape, capped at 256 KiB in total, that tools read by key but nothing can select on.

kubectl create only makes new objects and fails if the name exists. kubectl replace overwrites an existing object with the whole file. kubectl apply creates or updates by merging the file into the live object and leaves fields it never set alone.

Kubernetes labels are key/value pairs on an object's metadata. A label selector lists requirements, all of which must match: equality (=, !=) or set-based (in, notin, exists). Services, ReplicaSets and kubectl use selectors to find objects.

Helm renders a chart's Go templates against values, so the final YAML is generated from files that are not YAML. Kustomize patches complete YAML instead. Helm also stores each apply as a release; kubectl apply -k stores nothing.

helm upgrade runs once: it renders the chart, sends the result to the API server, records a new release revision and exits. Nothing then watches the cluster, so drift survives until somebody runs Helm again.

helm lint parses the chart metadata, renders the templates with the values it is given, and reports INFO, WARNING and ERROR findings. It never contacts a cluster, so a manifest that renders as valid YAML but is an invalid Kubernetes object still passes.

Defaults that render runnable YAML with no -f file: every key a template reads is present and typed, empty extension points declared as {} or [], nothing secret or site-specific baked in, and required inputs failing the render loudly.

version is the chart package's own version and must be valid SemVer 2; Helm names the tarball, indexes and resolves the chart from it. appVersion is a free-form label naming the application release the chart ships, and Helm never parses it.

Swarm mode turns several engines into one cluster of manager and worker nodes. A service is declared desired state — image, replica count, update policy — and managers keep that many tasks (containers) running, rescheduling them when containers or nodes fail.

The manager updates the service spec and replaces tasks in batches. update_config sets parallelism, delay, order (stop-first or start-first), monitor window, max failure ratio and failure_action (pause, continue, rollback). docker service rollback restores the previous spec.

docker compose up runs containers on one engine and can build images. docker stack deploy sends the file to swarm managers, which create services across the cluster; it honours the deploy: section and ignores single-host keys such as build, container_name, depends_on and links.

Managers replicate cluster state with Raft, so use an odd number — 3 or 5 — tolerating (N-1)/2 failures. Losing quorum freezes all cluster changes while existing tasks keep running. Recover by restoring managers, or run docker swarm init --force-new-cluster on a survivor.

Published ports use the ingress overlay network and routing mesh: every node listens on the port and load balances to a task anywhere via IPVS. Container-to-container traffic runs over VXLAN-encapsulated overlay networks, with service names resolving to a virtual IP.

Delivery and consumption are separate events. The process parsed the file once at start-up and serves from that in-memory copy; nothing re-reads it unless the process was written to, so the old value stands until it re-reads or is replaced.

Only the values supplied around the artifact may differ: endpoints, credentials, copy count, verbosity, feature switches. The image bytes stay identical, because identical bytes are what makes an earlier environment's test evidence mean anything in production.

Everyone who can obtain the artifact holds the credential, because the value travels with the image to every registry, mirror, host and environment it reaches. Changing it means building a new artifact and rolling it out, so rotation becomes a release.

Two shapes: a flat set of name-value pairs the process inherits when it is created, or a directory of files mounted into its filesystem. The choice decides who else can read the value and what changing it costs.

Everything the distribution shipped that the process does not carry itself: the shell and its utilities, the package manager, usually the trusted-certificate store, timezone and locale data, and most system libraries. Only the artifact and whatever the build copied in remain.