Glossary

Containers & Kubernetes

Essential terms every DevOps engineer should know about containers and Kubernetes.

63 Terms Published: 11 Apr, 2026

Devops #containers #docker #kubernetes #orchestration

Containers

Container

A lightweight, standalone, executable package that includes everything needed to run a piece of software code, runtime, libraries, and settings isolated from the host system.

Example

Running an Nginx web server inside a Docker container without installing Nginx on the host.

Code Snippet

1
docker run -d -p 80:80 nginx

Docker

An open platform for building, shipping, and running applications inside containers, providing tooling to create images, manage containers, and interact with registries.

Example

Building a custom Node.js application image using a Dockerfile.

Code Snippet

1
docker build -t myapp:latest .

Dockerfile

A text file containing ordered instructions that Docker follows to automatically build a container image, layer by layer.

Example

A Dockerfile that sets up a Python Flask application with all its dependencies.

Code Snippet

1
```dockerfile
2
FROM python:3.11-slim
3
WORKDIR /app
4
COPY requirements.txt .
5
RUN pip install -r requirements.txt
6
COPY . .
7
CMD ["python", "app.py"]
8
```

Docker Image

A read-only, layered template used to create containers. Built from a Dockerfile and stored in a registry. Each layer represents a set of filesystem changes.

Example

Pulling the official PostgreSQL 15 image from Docker Hub to use as a base.

Code Snippet

1
docker pull postgres:15

Docker Layer

Each instruction in a Dockerfile creates a read-only layer in the resulting image. Layers are cached and reused across builds to improve performance.

Example

A RUN apt-get install layer is cached and not rebuilt if the instruction has not changed.

Code Snippet

1
```dockerfile
2
RUN apt-get update && apt-get install -y curl
3
# This becomes one cached layer
4
```

Docker Compose

A tool for defining and running multi-container Docker applications using a YAML file, allowing you to start all services with a single command.

Example

Running a web app, a Redis cache, and a PostgreSQL database together with docker compose up.

Code Snippet

1
```yaml
2
services:
3
  web:
4
    image: myapp
5
    ports:
6
      - "8080:8080"
7
  db:
8
    image: postgres:15
9
```

Container Registry

A storage and distribution service for Docker images, allowing teams to push, pull, version, and share images across environments.

Example

Pushing a built image to Amazon ECR after a successful CI pipeline run.

Code Snippet

1
docker push 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:latest

Docker Hub

The default public container registry provided by Docker, hosting official images for popular software as well as user-published images.

Example

Pulling the official Node.js image from Docker Hub as a base for a custom application.

Code Snippet

1
docker pull node:18-alpine

Base Image

The starting point for a Dockerfile, specified in the FROM instruction. It provides the OS and runtime environment on top of which your application is built.

Example

Using node:18-alpine as a base image to keep the final image small.

Code Snippet

1
FROM node:18-alpine

Multi-stage Build

A Dockerfile technique that uses multiple FROM instructions to separate the build environment from the final runtime image, reducing the size of the produced image.

Example

Compiling a Go binary in one stage and copying only the binary into a minimal final image.

Code Snippet

1
```dockerfile
2
FROM golang:1.21 AS builder
3
RUN go build -o app .
4

5
FROM alpine:3.18
6
COPY --from=builder /app /app
7
CMD ["/app"]
8
```

Container Runtime

The low-level software responsible for running containers on a host, managing their lifecycle including starting, stopping, and isolating them using OS primitives.

Example

containerd and CRI-O are common container runtimes used by Kubernetes nodes.

Code Snippet

1
systemctl status containerd

Volume

A mechanism for persisting data generated by and used by Docker containers, existing outside the container lifecycle so data survives container restarts or deletion.

Example

Mounting a named volume to persist a PostgreSQL database across container restarts.

Code Snippet

1
docker run -v pgdata:/var/lib/postgresql/data postgres:15

Bind Mount

A type of Docker mount that maps a specific file or directory on the host machine directly into a container, enabling live file sharing between host and container.

Example

Mounting a local source code directory into a development container to enable hot reloading.

Code Snippet

1
docker run -v $(pwd):/app myapp:dev

Container Network

A virtual network that Docker creates to allow containers to communicate with each other and with the outside world, with different drivers supporting different topologies.

Example

Creating a bridge network so that a web container can reach a database container by name.

Code Snippet

1
docker network create mynetwork

.dockerignore

A file that specifies patterns of files and directories to exclude from the Docker build context, reducing build time and preventing secrets from being included in images.

Example

Excluding node_modules and .env files from the Docker build context.

Code Snippet

1
```
2
node_modules
3
.env
4
*.log
5
.git
6
```

Container Orchestration

The automated management of containerized workloads across multiple hosts, handling deployment, scaling, networking, and self-healing of containers at scale.

Example

Kubernetes automatically restarting a failed container and rescheduling it on a healthy node.

Code Snippet

1
kubectl get pods --watch

Kubernetes Configuration

ConfigMap

A Kubernetes object used to store non-sensitive configuration data as key-value pairs, decoupling configuration from container images.

Example

Storing application feature flags and environment-specific settings in a ConfigMap.

Code Snippet

1
```yaml
2
apiVersion: v1
3
kind: ConfigMap
4
metadata:
5
  name: app-config
6
data:
7
  LOG_LEVEL: "info"
8
  MAX_CONNECTIONS: "100"
9
```

Secret

A Kubernetes object that stores sensitive data such as passwords, tokens, and TLS certificates, keeping them separate from application code and pod specs.

Example

Storing a database password as a Kubernetes Secret and injecting it as an environment variable.

Code Snippet

1
kubectl create secret generic db-secret --from-literal=password=mypassword

ResourceQuota

A Kubernetes policy that limits the aggregate resource consumption per namespace, controlling how much CPU, memory, and object count a team can use.

Example

Limiting the staging namespace to a maximum of 8 CPU cores and 16Gi of memory.

Code Snippet

1
```yaml
2
apiVersion: v1
3
kind: ResourceQuota
4
spec:
5
  hard:
6
    requests.cpu: "8"
7
    requests.memory: 16Gi
8
```

LimitRange

A Kubernetes policy that sets default and maximum resource requests and limits for containers in a namespace, preventing unbounded resource consumption.

Example

Setting a default memory limit of 512Mi for all containers in the dev namespace.

Code Snippet

1
```yaml
2
apiVersion: v1
3
kind: LimitRange
4
spec:
5
  limits:
6
  - default:
7
      memory: 512Mi
8
    type: Container
9
```

Kubernetes Core

Kubernetes (K8s)

An open-source container orchestration platform originally developed by Google that automates deploying, scaling, and managing containerized applications across clusters.

Example

Running a production web application across 10 nodes with automatic scaling and self-healing.

Code Snippet

1
kubectl cluster-info

Cluster

A set of machines (nodes) that run containerized applications managed by Kubernetes, consisting of at least one control plane and one or more worker nodes.

Example

A production EKS cluster with 3 control plane nodes and 10 worker nodes across 3 availability zones.

Code Snippet

1
kubectl get nodes

Control Plane

The set of components that manage the overall state of the Kubernetes cluster, including scheduling workloads, maintaining desired state, and serving the API.

Example

The control plane detects that a pod has crashed and schedules a replacement on a healthy node.

Code Snippet

1
kubectl get componentstatuses

Node

A physical or virtual machine in a Kubernetes cluster that runs workloads. Each node contains a kubelet, container runtime, and kube-proxy.

Example

A worker node running five pods across two namespaces.

Code Snippet

1
kubectl describe node my-node

Pod

The smallest deployable unit in Kubernetes, consisting of one or more tightly coupled containers that share the same network namespace, IP address, and storage volumes.

Example

A pod containing an application container and a sidecar container for log shipping.

Code Snippet

1
```yaml
2
apiVersion: v1
3
kind: Pod
4
metadata:
5
  name: my-pod
6
spec:
7
  containers:
8
  - name: app
9
    image: myapp:latest
10
```

Namespace

A Kubernetes mechanism for isolating groups of resources within a single cluster, providing scope for names, resource quotas, and access control policies.

Example

Using separate namespaces for dev, staging, and production environments in the same cluster.

Code Snippet

1
kubectl create namespace staging

etcd

A distributed key-value store used by Kubernetes as its primary backing store for all cluster state and configuration data.

Example

All Kubernetes objects pods, services, configmaps are persisted in etcd.

Code Snippet

1
etcdctl get /registry/pods/default/my-pod

kube-scheduler

The Kubernetes control plane component responsible for assigning newly created pods to nodes, based on resource requirements, constraints, and policies.

Example

The scheduler placing a pod with 4 CPU requests on a node that has sufficient available capacity.

Code Snippet

1
kubectl -n kube-system get pod -l component=kube-scheduler

kube-proxy

A network component that runs on each node and maintains network rules to forward traffic destined for Services to the correct pod endpoints.

Example

kube-proxy updating iptables rules when a new pod is added to a Service endpoint.

Code Snippet

1
kubectl -n kube-system get pod -l k8s-app=kube-proxy

Kubernetes Networking

Service

A Kubernetes abstraction that provides a stable network endpoint for accessing a set of pods, with built-in load balancing and DNS-based service discovery.

Example

Exposing a backend deployment internally to other services using a ClusterIP Service.

Code Snippet

1
```yaml
2
apiVersion: v1
3
kind: Service
4
spec:
5
  selector:
6
    app: backend
7
  ports:
8
  - port: 80
9
    targetPort: 8080
10
```

ClusterIP

The default Kubernetes Service type that exposes the service on an internal cluster IP, making it reachable only from within the cluster.

Example

A database service exposed only internally to application pods in the same cluster.

Code Snippet

1
```yaml
2
spec:
3
  type: ClusterIP
4
  ports:
5
  - port: 5432
6
```

NodePort

A Kubernetes Service type that exposes the service on a static port on each node's IP, making it accessible from outside the cluster via any node's IP and that port.

Example

Exposing a development application externally on port 30080 for testing.

Code Snippet

1
```yaml
2
spec:
3
  type: NodePort
4
  ports:
5
  - port: 80
6
    nodePort: 30080
7
```

LoadBalancer

A Kubernetes Service type that provisions an external cloud load balancer and assigns a public IP, forwarding traffic into the cluster's pods.

Example

Exposing a production web application publicly using a LoadBalancer Service on AWS EKS.

Code Snippet

1
```yaml
2
spec:
3
  type: LoadBalancer
4
  ports:
5
  - port: 443
6
```

Ingress

A Kubernetes API object that manages external HTTP and HTTPS access to services, providing routing rules, TLS termination, and virtual hosting in one place.

Example

Routing traffic to different microservices based on URL path using an Nginx Ingress controller.

Code Snippet

1
```yaml
2
apiVersion: networking.k8s.io/v1
3
kind: Ingress
4
spec:
5
  rules:
6
  - host: app.example.com
7
    http:
8
      paths:
9
      - path: /api
10
        backend:
11
          service:
12
            name: api-service
13
```

Ingress Controller

A pod that runs inside the cluster and implements the Ingress rules, acting as a reverse proxy and load balancer for incoming traffic. Common options include Nginx and Traefik.

Example

Installing the Nginx Ingress Controller via Helm to handle all incoming HTTP traffic.

Code Snippet

1
helm install ingress-nginx ingress-nginx/ingress-nginx

Kubernetes Reliability

Liveness Probe

A Kubernetes health check that determines if a container is still running correctly. If the probe fails, Kubernetes restarts the container automatically.

Example

A liveness probe hitting /healthz every 10 seconds and restarting the container if it fails 3 times.

Code Snippet

1
```yaml
2
livenessProbe:
3
  httpGet:
4
    path: /healthz
5
    port: 8080
6
  initialDelaySeconds: 10
7
  periodSeconds: 10
8
```

Readiness Probe

A Kubernetes health check that determines if a container is ready to accept traffic. Pods that fail the readiness probe are removed from Service endpoints until they recover.

Example

A readiness probe preventing traffic from reaching a pod while it initializes its database connection.

Code Snippet

1
```yaml
2
readinessProbe:
3
  httpGet:
4
    path: /ready
5
    port: 8080
6
  initialDelaySeconds: 5
7
  periodSeconds: 5
8
```

Startup Probe

A Kubernetes health check that gives slow-starting containers extra time to initialize before liveness and readiness probes take over, preventing premature restarts.

Example

A startup probe allowing a legacy Java application up to 3 minutes to start before checking health.

Code Snippet

1
```yaml
2
startupProbe:
3
  httpGet:
4
    path: /healthz
5
    port: 8080
6
  failureThreshold: 30
7
  periodSeconds: 10
8
```

Rolling Update

A Kubernetes Deployment strategy that gradually replaces old pod replicas with new ones, ensuring zero downtime by keeping some replicas available throughout the update.

Example

Deploying a new application version by replacing pods one at a time while maintaining availability.

Code Snippet

1
```yaml
2
strategy:
3
  type: RollingUpdate
4
  rollingUpdate:
5
    maxSurge: 1
6
    maxUnavailable: 0
7
```

Pod Disruption Budget (PDB)

A Kubernetes policy that limits the number of pods of a replicated application that can be simultaneously unavailable during voluntary disruptions such as node drains.

Example

Ensuring at least 2 replicas of a web service are always available during a node upgrade.

Code Snippet

1
```yaml
2
apiVersion: policy/v1
3
kind: PodDisruptionBudget
4
spec:
5
  minAvailable: 2
6
  selector:
7
    matchLabels:
8
      app: my-web
9
```

Kubernetes Scaling

HorizontalPodAutoscaler (HPA)

A Kubernetes resource that automatically scales the number of pod replicas in a Deployment based on observed CPU utilization or custom metrics.

Example

Automatically scaling a web deployment from 2 to 20 replicas based on CPU usage exceeding 60%.

Code Snippet

1
kubectl autoscale deployment my-app --cpu-percent=60 --min=2 --max=20

VerticalPodAutoscaler (VPA)

A Kubernetes component that automatically adjusts the CPU and memory resource requests and limits of containers based on historical usage patterns.

Example

Using VPA to right-size a memory-hungry container that was over-provisioned at initial deployment.

Code Snippet

1
```yaml
2
apiVersion: autoscaling.k8s.io/v1
3
kind: VerticalPodAutoscaler
4
spec:
5
  updatePolicy:
6
    updateMode: Auto
7
```

Cluster Autoscaler

A Kubernetes component that automatically adjusts the number of nodes in a cluster when pods cannot be scheduled due to resource constraints or nodes are underutilized.

Example

The Cluster Autoscaler adding a new node to AWS EKS when pending pods cannot be scheduled.

Code Snippet

1
kubectl -n kube-system logs deployment/cluster-autoscaler

Kubernetes Scheduling

Taint & Toleration

A Kubernetes mechanism where taints are applied to nodes to repel pods, and tolerations are applied to pods to allow them to schedule onto tainted nodes.

Example

Tainting GPU nodes so only ML workloads with the correct toleration can be scheduled on them.

Code Snippet

1
```yaml
2
tolerations:
3
- key: "gpu"
4
  operator: "Equal"
5
  value: "true"
6
  effect: "NoSchedule"
7
```

Node Affinity

A Kubernetes scheduling rule that constrains which nodes a pod can be scheduled onto based on node labels, offering more expressive rules than node selectors.

Example

Scheduling data-intensive pods exclusively onto nodes in the us-east-1a availability zone.

Code Snippet

1
```yaml
2
affinity:
3
  nodeAffinity:
4
    requiredDuringSchedulingIgnoredDuringExecution:
5
      nodeSelectorTerms:
6
      - matchExpressions:
7
        - key: topology.kubernetes.io/zone
8
          operator: In
9
          values: [us-east-1a]
10
```

Kubernetes Security

RBAC (Role-Based Access Control)

A Kubernetes authorization mechanism that regulates access to cluster resources based on the roles assigned to users or service accounts.

Example

Granting a CI/CD service account permission to deploy to the production namespace only.

Code Snippet

1
```yaml
2
apiVersion: rbac.authorization.k8s.io/v1
3
kind: Role
4
rules:
5
- apiGroups: ["apps"]
6
  resources: ["deployments"]
7
  verbs: ["get", "update"]
8
```

ServiceAccount

A Kubernetes identity assigned to pods, allowing them to authenticate to the Kubernetes API and interact with cluster resources according to their RBAC permissions.

Example

Assigning a ServiceAccount to a pod that needs to list other pods in the same namespace.

Code Snippet

1
```yaml
2
apiVersion: v1
3
kind: ServiceAccount
4
metadata:
5
  name: app-service-account
6
  namespace: production
7
```

NetworkPolicy

A Kubernetes resource that controls the traffic flow at the IP address or port level between pods and external endpoints, acting as a firewall within the cluster.

Example

Restricting a database pod to only accept connections from pods with the label app=backend.

Code Snippet

1
```yaml
2
apiVersion: networking.k8s.io/v1
3
kind: NetworkPolicy
4
spec:
5
  ingress:
6
  - from:
7
    - podSelector:
8
        matchLabels:
9
          app: backend
10
```

Kubernetes Storage

PersistentVolume (PV)

A piece of storage in the cluster provisioned by an administrator or dynamically by a StorageClass, with a lifecycle independent of any pod that uses it.

Example

A 100Gi EBS volume provisioned as a PersistentVolume for a PostgreSQL StatefulSet.

Code Snippet

1
```yaml
2
apiVersion: v1
3
kind: PersistentVolume
4
spec:
5
  capacity:
6
    storage: 100Gi
7
  accessModes:
8
    - ReadWriteOnce
9
```

PersistentVolumeClaim (PVC)

A request for storage by a user that consumes a PersistentVolume, specifying size and access mode. Kubernetes binds the PVC to a suitable PV automatically.

Example

A pod requesting 10Gi of storage via a PVC that Kubernetes binds to an available PV.

Code Snippet

1
```yaml
2
apiVersion: v1
3
kind: PersistentVolumeClaim
4
spec:
5
  accessModes:
6
    - ReadWriteOnce
7
  resources:
8
    requests:
9
      storage: 10Gi
10
```

StorageClass

A Kubernetes resource that defines different classes of storage with their provisioner and parameters, enabling dynamic provisioning of PersistentVolumes on demand.

Example

A StorageClass backed by AWS gp3 EBS volumes that auto-provisions storage when a PVC is created.

Code Snippet

1
```yaml
2
apiVersion: storage.k8s.io/v1
3
kind: StorageClass
4
provisioner: ebs.csi.aws.com
5
parameters:
6
  type: gp3
7
```

Kubernetes Tooling

Helm

A package manager for Kubernetes that uses charts to define, install, and upgrade complex Kubernetes applications, simplifying repeatable deployments.

Example

Installing a full Prometheus + Grafana monitoring stack with a single Helm install command.

Code Snippet

1
helm install monitoring prometheus-community/kube-prometheus-stack

Helm Chart

A collection of files that describe a related set of Kubernetes resources, packaged together with configurable values to enable reusable and versioned application deployments.

Example

A Helm chart for a web application with configurable replicas, image tag, and ingress hostname.

Code Snippet

1
```
2
mychart/
3
  Chart.yaml
4
  values.yaml
5
  templates/
6
    deployment.yaml
7
    service.yaml
8
```

kubectl

The command-line tool for interacting with Kubernetes clusters, allowing you to deploy applications, inspect resources, and manage cluster operations.

Example

Using kubectl to view all pods across all namespaces and their current status.

Code Snippet

1
kubectl get pods --all-namespaces

kubeconfig

A YAML file that stores cluster connection details, credentials, and context configurations, used by kubectl to authenticate and communicate with Kubernetes clusters.

Example

Switching between a staging and production cluster context using kubectl.

Code Snippet

1
kubectl config use-context production-cluster

Kubernetes Workloads

Deployment

A Kubernetes resource that declaratively manages a set of identical, stateless pod replicas, supporting rolling updates, rollbacks, and scaling.

Example

Scaling a web application from 3 to 10 replicas during peak traffic.

Code Snippet

1
kubectl scale deployment my-app --replicas=10

ReplicaSet

A Kubernetes resource that ensures a specified number of pod replicas are running at any given time. Usually managed by a Deployment rather than directly.

Example

A ReplicaSet maintaining exactly 3 running replicas of a web server pod.

Code Snippet

1
kubectl get replicasets

StatefulSet

A Kubernetes workload resource for managing stateful applications, providing stable pod identities, ordered deployment, and persistent storage per pod.

Example

Running a 3-node Kafka cluster using a StatefulSet with persistent volumes for each broker.

Code Snippet

1
```yaml
2
apiVersion: apps/v1
3
kind: StatefulSet
4
metadata:
5
  name: kafka
6
spec:
7
  serviceName: kafka
8
  replicas: 3
9
```

DaemonSet

A Kubernetes resource that ensures a copy of a specific pod runs on every node (or a subset of nodes) in the cluster, commonly used for logging and monitoring agents.

Example

Deploying a Fluentd log collector pod on every node using a DaemonSet.

Code Snippet

1
```yaml
2
apiVersion: apps/v1
3
kind: DaemonSet
4
metadata:
5
  name: fluentd
6
```

Job

A Kubernetes resource that creates one or more pods to execute a finite task and ensures they run to successful completion, then terminates.

Example

Running a database migration script as a Kubernetes Job before deploying a new application version.

Code Snippet

1
```yaml
2
apiVersion: batch/v1
3
kind: Job
4
metadata:
5
  name: db-migration
6
```

CronJob

A Kubernetes resource that creates Jobs on a repeating schedule defined using cron syntax, useful for periodic batch tasks like backups or report generation.

Example

Running a nightly database backup job at 2:00 AM using a CronJob.

Code Snippet

1
```yaml
2
apiVersion: batch/v1
3
kind: CronJob
4
spec:
5
  schedule: "0 2 * * *"
6
```

Init Container

A specialized container that runs to completion before app containers in a pod start, used for setup tasks such as waiting for a dependency or initializing config files.

Example

An init container waiting for a database to be ready before the main application container starts.

Code Snippet

1
```yaml
2
initContainers:
3
- name: wait-for-db
4
  image: busybox
5
  command: ['sh', '-c', 'until nc -z db 5432; do sleep 2; done']
6
```

Sidecar Container

A helper container that runs alongside the main application container in the same pod, augmenting or supporting its functionality without modifying the main image.

Example

A Fluentd sidecar container collecting and forwarding logs from the main application container.

Code Snippet

1
```yaml
2
containers:
3
- name: app
4
  image: myapp
5
- name: log-shipper
6
  image: fluentd
7
```