Technology
Containers and Kubernetes for agency applications
What containers are, when orchestration is worth it, and a right-sized approach for public agencies.
Containers package an application with its dependencies so it runs the same way everywhere. Kubernetes orchestrates containers across a cluster: scheduling, scaling, and restarting them. Both are mainstream, and both are frequently over-applied.
What containers give an agency
Consistency between development, test, and production. Faster, more reliable deployments. Easier isolation of applications from each other. A standard unit that cloud platforms and pipelines understand.
When orchestration is worth it
Many services with independent scaling needs, frequent deployments, a team that can operate a cluster, and workloads that benefit from self-healing and rolling updates. Large agencies with platform teams fit this description.
When it is not
A handful of applications, a small team, and modest traffic. Managed container services that hide the cluster, or platform-as-a-service offerings, deliver most of the benefit with far less operational burden.
A right-sized approach
- Containerize applications as they are modernized, with images built in the pipeline and scanned.
- Run them on a managed container platform from the cloud provider.
- Adopt full orchestration only when the number of services and the team's capacity justify it.
Security considerations
Minimal base images, non-root containers, image scanning, secrets kept out of images, network policies between services, and regular rebuilds to pick up patches.
Cost
Orchestration platforms charge for the control plane and for nodes that run whether or not they are busy. Managed serverless container services charge per use and often cost less for small workloads.
Skills
Kubernetes expertise is specialized. Agencies without it should either use managed services that abstract it away or ensure their vendor delivers documentation and training with any cluster.