Umhlahlandlela ophelele wokuphepha kwesitsha se-Docker

I-Informec Digital » Izinsiza » Umhlahlandlela Ophelele Wokuphepha Kwesitsha Se-Docker

I-Docker ishintshe unomphela indlela esithuthukisa futhi sithumela ngayo izinhlelo zokusebenza : ikhodi yokupakisha, imitapo yolwazi, kanye nokucushwa esitsheni nokuyihambisa kusuka ku-laptop yakho iye ekukhiqizeni ngaphandle kokumangala cishe kuyimilingo ( kuyini i-Docker ). Kodwa lomlingo unezingqinamba: uma singanaki ukuphepha, isitsha esisodwa esingalungiselelwe kahle singasebenza njengesango eliya kuyo yonke ingqalasizinda.

Amaqembu amaningi asathemba ngokungazi ukuthi ukuhlukaniswa kweziqukathi kanye nokuhlelwa kwe-Kubernetes (bheka i-Docker Compose kanye ne-Kubernetes ) kuyindawo evikelekile, kanti empeleni sikhuluma ngezinqubo ezabelana ngama-kernel, amanethiwekhi, futhi, ezimweni eziningi kakhulu, izimvume eziningi kakhulu. Ake sibheke ngokuningiliziwe ukuthi kungani ukuphepha kweziqukathi ze-Docker kuyisinsika esibalulekile, yiziphi izingozi zangempela ezikhona, nokuthi yimaphi amasu namathuluzi asetshenziswayo njengamanje ekukhiqizeni ukuze anciphise ngaphandle kokudela ukuqina kwe-DevOps.

Kuyini ngempela ukuphepha kwesitsha se-Docker?

Uma sikhuluma ngokuphepha kweziqukathi ze-Docker, sibhekisela kusethi yemikhuba, ukucushwa, namathuluzi avikela iziqukathi, umsingathi, inethiwekhi, kanye nochungechunge lokuhlinzekwa kwesofthiwe uqobo ekungcoleni, ekulungiselelweni okungalungile, nasekuhlaselweni okusebenzayo. Akukhona nje "ukugcina isithombe sobungcweti," kodwa mayelana nokuvikela yonke impilo: ukwakha, ukushicilela, ukuhambisa, nokusebenza.

Inselele enkulu ngama-container ukuthi abelana nge-kernel yesistimu yokusebenza ye-host ( izikhala zamagama nama-cgroups ku-Linux ). Lokhu kusho ukuthi ubuthakathaka bezinga le-kernel noma ukuphunyuka kwesitsha okungavikelwe kahle kungathinta zonke izitsha ku-node. Ngakho-ke, ukuphepha kwe-Docker akugcini nje ngokubonakala: kuhilela ukuqinisa i-host, ukukhawulela amalungelo, ukuhlukanisa amanethiwekhi, ukulawula ukuthi ubani oxhumana ne-API ye-daemon, nokuthi izimfihlo ziphathwa kanjani.

Esinye isici esibalulekile ukuphepha kwenqubo kanye nokuhlelwa : ukuthi izitsha zisebenza kanjani, ukuthi zisebenza ngaphansi kwamuphi umsebenzisi, ukuthi zinamakhono amangaki e-kernel, yiziphi izinsiza ezingazisebenzisa, nokuthi yiziphi izinqubomgomo ezisetshenziswa eqenjini le-Kubernetes. Lokhu kufaka phakathi imiqondo efana nomgomo welungelo elincane, amaphrofayili okuphepha (seccomp, AppArmor, SELinux), kanye nokulawula ukufinyelela okusekelwe ezindimeni (RBAC).

Izingozi zokuphepha ezivamile nezinkinga ku-Docker

Izigameko ezindaweni zamakhonteyina zivame ukuvela ekuhlanganisweni kwamaphutha abantu kanye nezinqumo zobuchwepheshe ezimbi . Okulandelayo yizinkinga ezivame kakhulu ezitholakale ekuhlolweni nasekuphulweni kwemithetho yangempela.

Izithombe ezisengozini noma ezinonya

Isithombe ngasinye sesitsha siyisistimu encane enesethi yaso yamaphakheji kanye nokuncika ; uma udonsa isithombe esidala, esikhukhumele, noma esingabazisayo, uthola nama-CVE aso, iminyango yangemuva, kanye nemikhuba emibi. Ukuskena kwezigidi zezithombe zomphakathi kubonise ukuthi ingxenye enkulu iqukethe i-malware noma ubuthakathaka obubalulekile obaziwayo.

Inkinga iba nkulu uma ukusatshalaliswa okuphelele (Ubuntu, Debian, njll.) kusetshenziswa njengesisekelo sezinhlelo zokusebenza ezidinga kuphela imitapo yolwazi embalwa. Lawo maphakheji engeziwe angamakhulu (abahleli, amagobolondo, abaphathi bamaphakheji, amathuluzi enethiwekhi, njll.) andisa indawo yokuhlasela ngaphandle kokwengeza noma yiliphi inani ekukhiqizweni. Kumhlaseli okwazile ukuthola ukufinyelela, ukuthola iskripthi se-apt-get noma se-curl esilungele ukulanda i-malware kuyisipho.

Phuma ezitsheni uye kumphathi

Ukuphunyuka kwesitsha kwenzeka lapho umhlaseli ekwazi ukushiya ibhokisi lesanti lesitsha bese enza izenzo ohlelweni lomsingathi noma kwezinye izitsha. Lokhu ngokuvamile kuhilela ukusebenzisa ubuthakathaka be-kernel, ukulungiselelwa okungavikelekile (njengamavolumu anokufinyelela okweqile), noma izitsha ezisebenza ngamalungelo okweqile.

Uma isitsha esithintekile sisebenza njengempande enamalungelo abanzi , ukuhlaselwa kwe-host noma yonke ingqalasizinda kulula kakhulu. Ngakho-ke ukugcizelela okuqhubekayo ekungasebenzisini i -`--privileged` , ukukhawulela amakhono e-kernel, kanye nokusebenzisa izinqubo ngabasebenzisi abangenamalungelo, kokubili ngaphakathi nangaphandle kwesitsha (izikhala zamagama zomsebenzisi, i-rootless, njll.).

Ukucushwa kwenethiwekhi okungavikelekile

Inethiwekhi ingenye indawo lapho i-Docker ne-Kubernetes zivame ukungahambi kahle khona : ama-port ashicilelwa ngokunganaki, ukusetshenziswa okungadingekile kwe- --network=host , izinqubomgomo zenethiwekhi ezingekho eqenjini, noma izitsha ezikhuluma zodwa ngaphandle kwemingcele.

Uma zonke izitsha zikwazi ukuxhumana ngokukhululeka , umhlaseli obeka engcupheni i-microservice angathuthela eceleni kudathabheyisi, emigqeni yemiyalezo, noma kumadeshibhodi angaphakathi. Ngaphezu kwalokho, ukudalula ngengozi izinsizakalo zokuphatha noma ama-API angaphakathi kuyimbangela ephindaphindayo yezehlakalo.

I-Daemon Docker iveziwe noma ayivikelekile kahle

I-Docker daemon "ubuchopho" obuphatha ukudalwa, ukubhujiswa, kanye nokulawulwa kweziqukathi . Uma i-API yayo ifinyeleleka ngaphandle kokubethela noma ukuqinisekiswa, noma ubani othola ukufinyelela angasebenzisa iziqukathi ezingahleliwe, afake amavolumu omphathi, afunde izimfihlo, noma asuse yonke ingqalasizinda.

Ukuvikela isokhethi ye-daemon kanye ne-API yayo kubalulekile : ukusebenzisa i-TLS, ukukhawulela ukufinyelela kusokhethi ye-Unix, ukungavezi i-TCP endpoint ngaphandle uma kudingeka ngempela, kanye nokuhlola njalo ukucushwa kwayo kuyizinyathelo eziyisisekelo zokugwema ukunikeza ukulawula kwepulatifomu.

Izimfihlo kanye nezimo zemvelo eziveziwe

Iphutha elivamile ezindaweni zesitsha ukushiya iziqinisekiso kanye nezinkinobho ze-API lapho kungafanele khona : zifakwe ku-Dockerfiles, ngaphakathi kwesithombe ngokwaso, eziguquguquki zemvelo ezisobala, noma zilayishwe ngengozi kulawulo lwenguqulo.

Uma imfihlo isifakwe ngaphakathi kwesithombe , noma ubani onokufinyelela kurejista noma esitsheni ngokwaso angayithola ngomyalo olula wokuhlola. Lokhu kufaka phakathi amaphasiwedi esizindalwazi, amathokheni esevisi angaphandle, noma okhiye bokufinyelela efwini—uhlobo lolwazi ongalufuni nhlobo ezandleni zomhlaseli.

Ubuthakathaka be-Kernel kanye nomsingathi

Njengoba zonke izitsha zabelana nge-kernel efanayo, noma yikuphi ukukhubazeka kulelo zinga kuthinta lonke uhlelo ( isibonisi sesistimu esithuthukisiwe se-Linux ). Uma uhlelo lwe-host lungalungiswanga noma lusebenzisa ama-kernel amadala, angasekelwa, amathuba okuba ukukhubazeka okungasetshenziswa esidlangalaleni anda kakhulu.

Ngaphezu kwe-kernel, ukucushwa kwesistimu yokusebenza ye-host (ama-cgroup, izikhala zamagama, amamojula alayishiwe, izinsizakalo ezingadingekile) kuthinta ngqo ingozi. I-host engalungiselelwe kahle yenza ukuhlukaniswa okunengqondo kweziqukathi kungabi nalutho.

Ukuntuleka kokubonakala nokuqapha

Ngaphandle kokurekhoda okuhle kanye nokuqapha ngesikhathi sangempela, ukuhlasela kungahlala kusebenza amasonto ngaphandle kokuqaphela muntu. Amathuluzi okuphepha endabuko (isibonelo, iyini i-Wazuh? ) avame ukwehluleka ukubona okwenzekayo ngaphakathi kwesitsha noma awakuhlobanisi nomongo we-Kubernetes.

Ukubonakala kwe-granular esitsheni kanye nezinga le-pod (izinqubo, ukuxhumana kwenethiwekhi, izinguquko zesistimu yamafayela, ukusetshenziswa kwezinsiza) kubalulekile ukuthola ukuziphatha okungavamile, izinkomba zokuyekethisa, kanye nokunyakaza okuseceleni.

Izindlela ezinhle kakhulu ngaphambi kokusebenzisa izitsha ze-Docker

Ukuphepha kwe-Docker kuqala isikhathi eside ngaphambi kokuba isitsha sifinyelele ekukhiqizweni . Kusukela ekukhethweni komsingathi kuya kufayela le-Docker, isinqumo ngasinye siyanezela noma siyasusa endaweni yokuhlasela.

Lungisa uhlelo lomsingathi

Isinyathelo sokuqala ukuba nesistimu yokusebenza ye-host ehlanzekile, esesikhathini enikezelwe kuma-container (bheka umhlahlandlela wokusetha nokuphatha i-Ubuntu Server ). Uma ungabelani kangako nge-node nezinye izinhlelo zokusebenza ezindala, kulapho ukwehluleka kwenye isevisi kungathinta khona imithwalo yakho yomsebenzi esema-container.

Ukuvuselela i-kernel ngokushesha nokukhetha izinguqulo ze-LTS ngokusekelwa okusebenzayo kunciphisa kakhulu ingozi yokuthi kusetshenziswe i-exploit eyaziwayo ukuze kugwenywe ukuhlukaniswa. Ngaphezu kwalokho, ukunika amandla nokulungisa kahle izindlela ezifana ne-AppArmor, i-SELinux, kanye nama-cgroups kusiza ukukhawulela lokho inqubo ethintekile engakwenza.

Khetha izithombe ezisemthethweni nezincane

Ukusebenzisa izithombe ezisemthethweni neziqinisekisiwe njengesisekelo kufanele kube yinto evamile . Izindawo zokugcina izithombe ezifana ne-Docker Hub ziqinisekisa abashicileli abaqinisekisiwe, kanye nezinkampani eziningi zigcina amarejista azimele anezithombe zazo eziqinisiwe, ezingaphansi kokuskenwa nokubuyekezwa okuqhubekayo.

Noma nini lapho kungenzeka, kuyalulekwa ukukhetha izithombe "ezincane," ze-Alpine, noma ezingenazo izithombe ezikude , okuhlanganisa kuphela ukuncika okudingekayo. Ukunciphisa inani lamaphakheji abasebenzisi namathuluzi asebenzisanayo kunciphisa inani lobuthakathaka obungaba khona, kusheshise ukuthunyelwa, futhi kwenza kube nzima kakhulu ngomhlaseli ukuthola ukusebenza kwekhodi ngaphakathi kwesitsha.

Yakha ama-Dockerfiles ucabange ngokuphepha

I-Dockerfile iyiskripthi sayo yonke into engena ngaphakathi kwesitsha sakho , ngakho-ke kungcono ukuyibhala ngengqondo eqinile: susa amathuluzi okulungisa amaphutha ekukhiqizeni, ungashiyi noma yimiphi iminonjana yeziqinisekiso, setha izinguqulo ezithile zephakheji, hlanza ama-cache abaphathi bephakheji, bese uhlukanisa izigaba zokuhlanganisa kanye nokwenza zibe yizingqimba eziningana (ukwakhiwa kwezigaba eziningi).

Esinye isinyathelo esibalulekile ukuchaza umsebenzisi ongenamalungelo ngaphakathi kwe-Dockerfile nokushintsha umongo wokusebenza ngomyalo othi `USER` . Ungalokothi uqalise izinsizakalo njengempande ngaphakathi kwesitsha "ngoba kulula"; ngokushesha nje lapho kuvela ubuthakathaka bokuphepha, lokho kulula kuzoba yinkinga enkulu.

Ukuskena isithombe okuhlelekile

Ukuskena izithombe ukuze kutholakale ubuthakathaka obaziwayo ngaphambi kokuba zibhaliswe kufanele kube yimpoqo . Amathuluzi afana namakhono e-Trivy, Clair, Anchore, Snyk Container, noma i-Docker Scout akuvumela ukuthi uhlaziye izithombe eziyisisekelo kanye nokwakhiwa ngokwezifiso.

Ukuhlanganisa lawa ma-scanner kumbhobho we-CI/CD kuvimbela isithombe esine-CVE ebalulekile ukuthi sisetshenziswe ekukhiqizweni "ngoba sikhohlwe ukusihlola." Okufanelekile, kufanele kuchazwe izinqubomgomo ezicacile: isibonelo, ukuvimba ukusetshenziswa uma kukhona ubuthakathaka obukhulu noma obubucayi ngaphandle kwe-patch etholakalayo noma isizathu esibhaliwe.

Ukuphathwa okuphephile kwezimfihlo kanye nokucushwa

Ukuphatha imfihlo kungenye yezindlela ezivamile zokuthumela izinto ezithwalayo . Ukuba nesithombe esiphelele akusizi ngalutho uma amaphasiwedi nezinkinobho zifakwe embhalweni ocacile ngaphakathi.

Umthetho wegolide uwukuthi izimfihlo akufanele neze zibe yingxenye yesithombe : ungalokothi ubhale iziqinisekiso kufayela le-Docker, noma uzikopishe njengamafayela esitsheni. Esikhundleni salokho, kufanele kusetshenziswe izindlela zokufaka i-runtime: Izimfihlo ze-Docker (ku-Swarm), abaphathi bangaphandle abanjengoHashiCorp Vault, i-AWS Secrets Manager, i-Azure Key Vault, noma ezinye izinsizakalo ezifanayo.

Uma kusetshenziswa izinto eziguquguqukayo zemvelo, kumele ziphathwe ngokucophelela okukhulu : gwema ukuzibhala kumarekhodi, ungalayishi amafayela anamanani angempela ezindaweni zokugcina amakhodi, buyekeza ukuthi yimiphi imiyalo yokuxilonga engabonisa amanani abucayi, futhi ujikeleze okhiye njalo. Ukubethela izimfihlo lapho ziphumule nokusebenzisa izilawuli zokufinyelela eziqinile (ubani ongafunda ukuthi yini) kuvala iminyango eminingi.

Inethiwekhi, ukulawula ukufinyelela, kanye nokuqiniswa komthetho

Uma izithombe kanye nomsingathi sezilawulwa, udinga ukucabangela ukuthi zixhumana kanjani, ukuthi ubani ongaziqalisa, nokuthi yini ezingayenza ngesikhathi sokusebenza . Yilapho ukuxhumana, i-RBAC, amakhono e-kernel, ama-resource quota, kanye namathuluzi okuqapha eqala ukusebenza khona.

Ukwakhiwa kwenethiwekhi kanye nokuhlukaniswa kwayo

Ku-Docker, kunconywa ukusebenzisa amanethiwekhi enziwe ngokwezifiso futhi ugweme ukushicilela amachweba ngaphandle ngaphandle uma kudingeka ngempela . Ukuchaza ibhuloho noma amanethiwekhi aqondene nesizinda noma uhlelo lokusebenza noma olusebenzayo kusiza ekunciphiseni ukuyekethisa okungenzeka (bheka ukwakheka kwe-microservices ).

Ezindaweni ezihlelwe yi-Kubernetes, Izinqubomgomo Zenethiwekhi zibalulekile : zikuvumela ukuthi uchaze ukuthi yimaphi ama-pod angaxhumana nawo, nokuthi yimaphi ama-port. Ngaphandle kwebhokisi, amaqoqo amaningi avumela ukuxhumana okungenamkhawulo phakathi kwama-pod, okulula ukuqala ngakho kodwa okuyingozi uma kwenzeka ukungena. Ukufaka ama-firewall e-Layer 7 kanye ne-TLS ekuxhumaneni phakathi kwezinsizakalo kunezela olunye ungqimba lokuvikela.

Ukulawula ukufinyelela, ukuqinisekiswa, kanye nokusayina isithombe

Ukufinyelela kumarejista, i-Docker API, kanye nendiza yokulawula i-Kubernetes kufanele kuhlale kudinga ubuqiniso obuqinile kanye nokulawulwa kwemvume . Akuwona wonke umuntu odinga ukukwazi ukusunduza izithombe noma ukuzithumela ekukhiqizweni.

I-Docker Content Trust kanye nezindlela zokusayina izithombe ziqinisekisa ukuthi kusetshenziswa izithombe ezisayinwe yizinhlangano ezithembekile kuphela. Ngesikhathi esifanayo, i-RBAC kokubili ku-Kubernetes kanye nepulatifomu ye-CI/CD ngokwayo ilawula ukuthi ubani ongaqalisa, alinganise, aguqule, noma asuse iziqukathi nezinsiza ezihlobene.

Sebenzisa izitsha ezinamalungelo aphansi kakhulu

Gwema ukusebenzisa izitsha ezine-`--privileged` ngoba ngeke kusebenze ngenye indlela . Lelo fulegi linikeza ukufinyelela okugcwele ku-host futhi lisusa izindlela eziningi zokuhlukanisa. Indlela efanele ukuqala izinsizakalo nge -`--cap-drop=ALL` bese ufaka kuphela amakhono e-kernel adingwa uhlelo lokusebenza (isibonelo, i-`NET_BIND_SERVICE` ukuze ulalele kuma-port aphansi).

Kubalulekile futhi ukusebenzisa izinhlelo zamafayela okufundwayo kuphela noma nini lapho kungenzeka ( `--read-only` ) bese ufaka amavolumu athile edatha edinga ukuqhubeka. Lokhu kwenza kube nzima ngomhlaseli ukubhala ama-binary anonya noma ukuguqula ukucushwa ngaphakathi kwesitsha. Ukunciphisa ukudalwa kwezinqubo ezintsha kanye nokukhubaza ukwanda kwamalungelo kuqeda ukuqina.

Amaphrofayili okuphepha e-Kernel: i-seccomp, i-AppArmor, kanye ne-SELinux

I-Docker isivele ifaka iphrofayili ye-seccomp ezenzakalelayo ehlunga izingcingo zesistimu ezibhekwa njengeziyingozi , kodwa ezimweni eziningi kuyalulekwa ukulungisa noma ukudala amaphrofayili athile ohlobo ngalunye lomsebenzi. Uma inqubo iveza izingcingo ezimbalwa zesistimu, amathuba amancane okusebenzisa atholakala.

Ekusabalalisweni okufana ne-Ubuntu ne-RHEL, i-AppArmor ne-SELinux zengeza olunye ungqimba lokulawula lokho isitsha ngasinye esingakwenza: ukufinyelela kumafayela, amadivayisi, amanethiwekhi, njll. Uma kulungiselelwe kahle, lezi zindlela zokulawula ukufinyelela okuphoqelekile zenza kube nzima kakhulu ukuthi ukuhlaselwa kuphumelele, noma ngabe kusebenzisa ubuthakathaka kuhlelo lokusebenza.

Izabelo zezinsiza kanye nokuvikelwa ekusetshenzisweni kabi

Ukulungiselela i-CPU, imemori, kanye, uma kusebenza, imikhawulo ye-I/O yesitsha ngasinye akusizi nje kuphela ukusebenza kweqoqo, kodwa futhi kunciphisa umthelela wokuhlaselwa okuzama ukuqeda izinsiza (i-DoS ngaphakathi) noma amaphutha abangela ukuvuza kwememori.

Ama-cgroup akuvumela ukuthi uchaze lawa ma-quota ngokunemba okukhulu futhi ayinhlanganisela yemvelo kwezinye izinyathelo zokuphepha. Umhlaseli ozama ukumba i-cryptocurrency ngaphakathi kwesitsha esinemikhawulo eqinile uzothola kunzima kakhulu ukuthinta ezinye izinsizakalo kumphathi.

Ukuqapha, impendulo yezehlakalo, kanye namathuluzi akhethekile

Ukuvala isithombe sokuphepha kwezitsha ngaphandle kokuxoxa ngokuqapha kungaba yiphutha . Iqiniso liwukuthi kuzovela ngokushesha noma kamuva ubuthakathaka obusha, amaphutha abantu, noma ukuziphatha okungalindelekile; umehluko uwukuthi uzibona ngokushesha kangakanani nokuthi usabela kanjani.

Ukuhlanganisa isitsha, umsingathi, ukuhlelwa kwemisebenzi, kanye namalogi okubhalisa kukuvumela ukuthi uhlobanise imicimbi futhi ukhombe amaphethini abengeke atholakale uma ingxenye ngayinye ibukwa ngokwehlukana. Izixazululo ezifana ne-ELK, i-Grafana Loki, noma izinsizakalo zamafu eziphethwe zivamile kule njongo.

Endaweni yokuthola izinsongo zesikhathi sokusebenza, i-Falco isibe yindinganiso evulekile yomthombo ovulekile . Ihlola izingcingo zesistimu futhi ikhiqize izexwayiso uma ithola umsebenzi osolisayo: amagobolondo asebenzisanayo ezitsheni okungafanele abe nawo, abhalela ezindleleni ezibucayi, ukuxhumana kwenethiwekhi okungavamile, njalo njalo. Ihlanganiswe namathuluzi e-SIEM noma amapulatifomu okuphendula, ivumela impendulo esheshayo.

Ukuze uthole ukumbozwa okubanzi, okugcwele, kunezinkundla zokuphepha ezisekelwe efwini ezifana ne-Aqua Security, i-Prisma Cloud, i-Sysdig Secure, i-Qualys Container Security, noma amasudi ahlanganisiwe agxile kunjiniyela njenge-Aikido Security. Lezi zixazululo zihlanganisa ukuskena izithombe, ukuphepha kwesikhathi sokusebenza, ukuphathwa kokuma kwamafu, ukuhlaziywa kwekhodi, ukutholwa okuyimfihlo, ukukhiqizwa kwe-SBOM, nokunye okuningi.

Inani elengeziwe lalezi zinkundla livame ukuhlanganiswa kokutholakele kanye nokubeka phambili okuhlakaniphile : esikhundleni sokugcwala amaqembu ngezinkulungwane zezaziso, aqokomisa ubuthakathaka obungasetshenziswa ngempela endaweni yakho, anikeze iziqondiso ezicacile zokulungisa, futhi aphakamise ngisho nama-patches asebenzisa i-AI ukuze onjiniyela bakwazi ukuzilungisa ngokushesha.

Ukuzenzakalelayo kokuphepha kuphayiphi ye-CI/CD

Ukuzama ukuphatha ukuphepha kweziqukathi ngesandla kuyindlela yokugwema nobuthakathaka . Yingakho esinye sezincomo eziphindaphindwayo kakhulu ukuhlanganisa konke ukuhlolwa okungenzeka kuphayiphi ye-CI/CD: uma izinkinga zitholakala ngokushesha, kulapho zizobiza khona ukuzilungisa.

Okungcono kakhulu, ushintsho ngalunye lwekhodi kufanele lubangele uchungechunge oluzenzakalelayo : ukwakhiwa kwesithombe, ukuskena kobungozi, ukuhlaziywa kokuxhomekeka, ukubuyekezwa kwefayela lengqalasizinda njengekhodi, ukuhlolwa kwenqubomgomo (isibonelo, ukuthi akukho sitsha esisebenza njengempande), futhi kuphela uma konke kudlula, cindezela uye kurejista kanye nokuthunyelwa.

Le ndlela inciphisa kakhulu ukuthembela kwinkumbulo noma ekuziphatheni komuntu ngamunye . Uma uhlelo lukuvimbela ekuthumeleni isithombe esinobuthakathaka obukhulu noma ukucushwa okwephula izinqubomgomo, kunzima kakhulu ukuthi into engamukeleki ingene ekukhiqizweni "ngokushesha." Ngaphezu kwalokho, ukwenza ngokuzenzakalelayo ukujikeleza kwesithombe kanye nokusabalalisa kabusha njalo kusiza ukugcina izinguqulo ezilungisiwe ngaso sonke isikhathi, kuvimbele ama-pod ukuthi asebenze nesofthiwe esiphelelwe yisikhathi izinyanga.

Ezinhlanganweni ezinamaqembu amaningi kanye nezinsizakalo ezincane eziningi , ukuba nepulatifomu ehlanganisiwe ehlanganisa ulwazi lokuphepha (ikhodi, izitsha, ifu, ukuncika) futhi enikeza umbono ocacile wengozi ngephrojekthi ngayinye kwenza impilo ibe lula kakhulu kubaphathi bezokuphepha kanye nabaholi bezobuchwepheshe.

Ekugcineni, ukuphepha kweziqukathi ze-Docker kanye namaqoqo e-Kubernetes akuxhomekile kuphela emshinini owodwa noma ethuluzini , kodwa kunalokho kuncike ekuhlanzekeni kwesithombe okuhle, isikhungo esilungisiwe kahle, amanethiwekhi ahlukene, amalungelo amancane, ukuphathwa kwezimfihlo okuqinile, ukuqapha okuqhubekayo, kanye nomthamo oqinile wokwenza ngokuzenzakalelayo kwamapayipi. Ukwenza le mikhuba ibe inqubo yansuku zonke, kunokuba kube amaphrojekthi enziwa kanye kuphela, yikho okwenza umehluko phakathi kwendawo "esebenza kuze kube yilapho kwenzeka okuthile" kanye nepulatifomu elungiselelwe ukusingatha izehlakalo ngaphandle kokufaka ibhizinisi engozini.