containerization

Multi-stage builds use separate build and runtime stages: compile dependencies in a builder stage, then copy only the artifacts into a slim runtime image. This reduces final image size by excluding build tools and caches.

Define resources.requests and resources.limits under each container in the pod spec, specifying memory and CPU values such as 256Mi and 250m. Requests guarantee scheduling capacity while limits cap maximum consumption.

ConfigMaps store non-sensitive configuration like environment variables and log levels in plain text. Secrets store sensitive data such as passwords and API keys, and both can be injected into containers via envFrom references.

Use Trivy to scan images by running it against the Docker socket with the target image name, or use docker build --scan during the build. Scanning should run in CI pipelines before pushing images to a registry.

The latest tag is mutable, so different nodes may pull different image versions, making deployments non-reproducible and rollbacks unreliable. Pin explicit version tags in Kubernetes manifests and Helm values instead.

Skip full orchestration patterns for simple local development where running Docker directly suffices, and for virtual machine management or general application deployment pipelines, which belong to CI/CD workflows instead.