DevOps - Containers & Orchestration

1. Containers & Docker Fundamentals

What are Containers?

Containers are lightweight, standalone, executable packages that include everything needed to run an application: code, runtime, system tools, system libraries, and settings.

Key Benefits:

• Consistency: Same behavior across environments

• Isolation: Apps run independently

• Portability: Run anywhere consistently

• Efficiency: Better resource utilization than VMs

• Scalability: Easy to replicate and scale

Docker Core Concepts

Dockerfile - Application Blueprint:

dockerfile

# Multi-stage build for optimization
FROM python:3.9-slim as builder

WORKDIR /app
COPY requirements.txt .
RUN pip install --user -r requirements.txt

FROM python:3.9-slim
WORKDIR /app
COPY --from=builder /root/.local /root/.local
COPY . .

ENV PATH=/root/.local/bin:$PATH
CMD ["python", "app.py"]

Essential Docker Commands:

bash

# Build image
docker build -t myapp:latest .

# Run container
docker run -d -p 8080:80 --name myapp myapp:latest

# Manage containers
docker ps
docker logs myapp
docker exec -it myapp bash

# Image management
docker images
docker push myregistry.com/myapp:latest

2. Docker Image Optimization

Optimization Strategies

1. Multi-stage Builds:

dockerfile

# Stage 1: Build
FROM node:16 as builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
RUN npm run build

# Stage 2: Production
FROM nginx:alpine
COPY --from=builder /app/build /usr/share/nginx/html
COPY nginx.conf /etc/nginx/nginx.conf
EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]

2. Layer Caching:

dockerfile

# Bad - loses cache on code changes
COPY . .
RUN npm install

# Good - preserves cache
COPY package*.json ./
RUN npm install
COPY . .

3. Base Image Selection:

• Alpine Linux: Smallest (~5MB)

• Distroless: Minimal, no shell

• Slim versions: Balanced size/functionality

4. Security Best Practices:

dockerfile

# Run as non-root user
RUN groupadd -r appuser && useradd -r -g appuser appuser
USER appuser

# Use trusted base images
FROM python:3.9-slim@sha256:abc123...

# Scan for vulnerabilities
docker scan myapp:latest

3. Kubernetes Core Objects

Pods

yaml

apiVersion: v1
kind: Pod
metadata:
  name: myapp-pod
  labels:
    app: myapp
    tier: frontend
spec:
  containers:
  - name: myapp-container
    image: myapp:1.0
    ports:
    - containerPort: 8080
    env:
    - name: DATABASE_URL
      value: "postgresql://localhost/mydb"
    resources:
      requests:
        memory: "64Mi"
        cpu: "250m"
      limits:
        memory: "128Mi"
        cpu: "500m"

Deployments

yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp
        image: myapp:1.0
        ports:
        - containerPort: 8080
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5

Services

yaml

apiVersion: v1
kind: Service
metadata:
  name: myapp-service
spec:
  selector:
    app: myapp
  ports:
  - name: http
    port: 80
    targetPort: 8080
  type: LoadBalancer

ConfigMaps and Secrets

yaml

# ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  app.properties: |
    database.host=postgresql
    cache.enabled=true
    log.level=INFO

# Secret
apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
data:
  username: YWRtaW4=
  password: cGFzc3dvcmQ=

4. Advanced Deployments

Blue-Green Deployment

yaml

# Blue deployment (current)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-blue
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
      version: "1.0"
  template:
    metadata:
      labels:
        app: myapp
        version: "1.0"
    spec:
      containers:
      - name: myapp
        image: myapp:1.0

# Green deployment (new)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-green
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
      version: "1.1"
  template:
    metadata:
      labels:
        app: myapp
        version: "1.1"
    spec:
      containers:
      - name: myapp
        image: myapp:1.1

# Service pointing to current version
apiVersion: v1
kind: Service
metadata:
  name: myapp-service
spec:
  selector:
    app: myapp
    version: "1.0"  # Switch to "1.1" for green deployment

Canary Deployment

yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-canary
spec:
  replicas: 1  # Small percentage of traffic
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
        version: "1.1"
    spec:
      containers:
      - name: myapp
        image: myapp:1.1

5. Autoscaling

Horizontal Pod Autoscaler (HPA)

yaml

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: myapp-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp-deployment
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
      - type: Percent
        value: 50
        periodSeconds: 60

Vertical Pod Autoscaler (VPA)

yaml

apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
  name: myapp-vpa
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp-deployment
  updatePolicy:
    updateMode: "Auto"

6. Cluster Management

Namespaces for Organization

yaml

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    name: production
    environment: prod
---
apiVersion: v1
kind: Namespace
metadata:
  name: development
  labels:
    name: development
    environment: dev

Resource Quotas

yaml

apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-quota
  namespace: production
spec:
  hard:
    requests.cpu: "10"
    requests.memory: 20Gi
    limits.cpu: "20"
    limits.memory: 40Gi
    pods: "50"
    services: "10"

Network Policies

yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: backend-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: database
    ports:
    - protocol: TCP
      port: 5432

7. Monitoring & Observability

Liveness and Readiness Probes

yaml

containers:
- name: myapp
  image: myapp:1.0
  livenessProbe:
    httpGet:
      path: /health
      port: 8080
    initialDelaySeconds: 30
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
  readinessProbe:
    httpGet:
      path: /ready
      port: 8080
    initialDelaySeconds: 5
    periodSeconds: 5
    timeoutSeconds: 3
    successThreshold: 1
    failureThreshold: 3
  startupProbe:
    httpGet:
      path: /health
      port: 8080
    initialDelaySeconds: 10
    periodSeconds: 10
    failureThreshold: 30

8. Career-Focused Skills

Essential Tools & Technologies:

• Container Runtimes: Docker, containerd

• Orchestration: Kubernetes, Docker Swarm

• Service Mesh: Istio, Linkerd

• CI/CD: Jenkins, GitLab CI, GitHub Actions

• Infrastructure as Code: Terraform, CloudFormation

• Monitoring: Prometheus, Grafana, ELK Stack

• Security: Trivy, Falco, OPA

Common Interview Topics:

1. Kubernetes Architecture: Master vs Worker nodes

2. Networking: CNI, Service Mesh, Ingress

3. Storage: PV, PVC, Storage Classes

4. Security: RBAC, Pod Security Policies

5. Troubleshooting: Pods, Services, Networking

6. Best Practices: Resource management, security

Real-World Scenarios to Practice:

1. Migration: Move legacy apps to containers

2. Scaling: Handle traffic spikes efficiently

3. Disaster Recovery: Cluster backup/restore

4. Cost Optimization: Right-sizing resources

5. Multi-cluster Management: Federation strategies

This comprehensive knowledge forms the foundation for roles like DevOps Engineer, Site Reliability Engineer, Cloud Engineer, and Platform Engineer. Mastering these concepts will make you highly valuable in today's cloud-native job market.