Catalog
concept#Platform#Architecture#DevOps#Security

Container

Containers are standardized, lightweight runtime environments that package, isolate, and enable portable execution of applications and their dependencies across environments.

Containers are lightweight, isolated runtime environments that package applications with their dependencies to run consistently across development, test, and production environments.
Established
Medium

Classification

  • Medium
  • Technical
  • Architectural
  • Intermediate

Technical context

container registry (e.g., Docker Hub, Artifactory)orchestration (e.g., Kubernetes)CI/CD systems (e.g., GitLab CI, GitHub Actions)

Principles & goals

Prefer isolation over full virtualizationImmutable images and declarative configurationSmall surface area, single responsibility per container
Build
Team, Domain

Use cases & scenarios

Compromises

  • Unsecure images lead to attack vectors
  • Lack of orchestration increases operational effort
  • Resource overcommitment can jeopardize stability
  • use small, focused images and multi-stage builds
  • sign and scan images before deployment
  • define resource limits and health probes

I/O & resources

  • application code and build instructions (e.g., Dockerfile)
  • container registry for image distribution
  • runtime environment / container runtime
  • versioned container images
  • deployment manifests (e.g., Kubernetes YAML)
  • running container instances

Description

Containers are lightweight, isolated runtime environments that package applications with their dependencies to run consistently across development, test, and production environments. They enable reproducible deployments, efficient resource utilization, and fast scaling, shape architectural choices, and require orchestration, security practices, and image lifecycle management. Proven practices and tools are essential for reliable operation.

✔

  • Portability across environments
  • Faster startup and deployment times
  • Improved resource utilization

✖

  • No complete kernel isolation like VMs
  • Lack of standardization of some runtime behaviors
  • Image size and build complexity can grow

  • container startup time

    Time from start command to service readiness; important for scalability and autoscaling.

  • image size

    Container image size affects transfer and startup times as well as registry storage needs.

  • resource consumption per container

    CPU and memory consumption for capacity planning and avoiding overcommit.

Microservice deployment at an e-commerce provider

Each microservice team delivers container images orchestrated by a Kubernetes platform; CI/CD automates builds and security checks.

Continuous delivery pipeline with container builds

Container images are versioned, signed in a registry, and rolled out to multiple environments via automated tests.

Platform for data processing jobs

Batch and streaming jobs run in isolated containers, easing portability between on-prem and cloud.

1

define minimal base images and build processes

2

automate image builds in CI and scan for vulnerabilities

3

establish image tagging, registry policies, and rollback processes

4

introduce orchestration and configure resource limits

⚠️ Technical debt & bottlenecks

  • unstructured image hierarchy without base standards
  • outdated base images without regular updates
  • missing automation for image scanning and signing
image build timeregistry performancenetwork overlay
  • running build tools directly in production image
  • leaving sensitive data inside images
  • manually patching running containers without rebuild
  • assumptions about host kernel features cause runtime failures
  • insufficient image scanning finds vulnerabilities too late
  • misconfigured resource limits cause OOM failures
experience with container builds and image optimizationknowledge of orchestration and deploymentsecurity awareness for runtime and images
Portability across environmentsScalability and elasticityFast delivery and continuous delivery
  • • host kernel compatibility
  • • policies for image signing and scanning
  • • resource quotas and limits at cluster level