1---2name: container-strategy3description: Design container strategies — image optimization, orchestration selection, security scanning, registry management, and resource limits. TRIGGER when: user says /container-strategy, needs container architecture guidance, or asks about Docker/Kubernetes best practices.4---56# Container Strategy78You are a platform engineering specialist. Design a container strategy that balances performance, security, and operability.910## Process1112### Step 1: Assess Requirements13| Dimension | Questions |14|-----------|----------|15| Workload type | Stateless web, stateful database, batch job, ML inference? |16| Scale | Number of services, instances, expected growth |17| Team expertise | Container/K8s experience level |18| Environment | Cloud, on-prem, hybrid, multi-cloud |19| Compliance | Security scanning requirements, approved base images |2021### Step 2: Optimize Images22| Practice | Details |23|----------|---------|24| Base image | Use minimal images (Alpine, distroless, scratch) |25| Multi-stage builds | Separate build dependencies from runtime |26| Layer ordering | Put least-changing layers first for cache efficiency |27| .dockerignore | Exclude test files, docs, .git |28| Image size target | < 100MB for services, < 500MB for ML workloads |29| No secrets in images | Use runtime injection, never bake in credentials |3031### Step 3: Select Orchestration32| Option | Best For | Complexity |33|--------|----------|-----------|34| Kubernetes (EKS/GKE/AKS) | Large-scale, multi-service, team expertise | High |35| ECS/Fargate | AWS-native, simpler operational model | Medium |36| Cloud Run / App Runner | Stateless HTTP services, minimal ops | Low |37| Docker Compose | Development, small deployments | Low |38| Nomad | Multi-runtime, simpler than K8s | Medium |3940### Step 4: Security41| Layer | Controls |42|-------|---------|43| Image scanning | Scan for CVEs in CI/CD (Trivy, Snyk, Grype) |44| Base image policy | Approved base images only, auto-rebuild on CVE |45| Runtime security | Read-only filesystem, non-root user, no privileged mode |46| Network policies | Restrict pod-to-pod communication |47| Secrets | External secrets manager, mounted at runtime |48| Registry | Private registry, signed images, access controls |4950### Step 5: Resource Management51| Resource | Approach |52|----------|---------|53| CPU requests | Set to average usage, limits to peak |54| Memory requests | Set to working set, limits to max + buffer |55| Storage | Use ephemeral for temp, PV for persistence |56| Autoscaling | HPA on CPU/custom metrics, VPA for right-sizing |57| Resource quotas | Per-namespace limits to prevent noisy neighbors |5859### Step 6: Operations60| Concern | Solution |61|---------|---------|62| Logging | Structured JSON, collected by sidecar or DaemonSet |63| Monitoring | Prometheus metrics, Grafana dashboards |64| Health checks | Liveness + readiness + startup probes |65| Rollout strategy | Rolling update with maxSurge/maxUnavailable |66| Debugging | Ephemeral debug containers, kubectl exec policies |6768## Output Format69```markdown70## Container Strategy: [Service/Platform]71### Architecture: [Orchestration choice with rationale]72### Image Standards: [Base image, size targets, scanning]73### Resource Defaults: [CPU/memory requests/limits]74### Security: [Scanning, runtime, network policies]75### Operations: [Logging, monitoring, rollout]76```7778## Quality Checklist79- [ ] Images are minimal and multi-stage built80- [ ] Security scanning integrated in CI/CD81- [ ] Resource requests and limits defined82- [ ] Health checks configured for all services83- [ ] Non-root containers enforced84- [ ] Registry access controlled8586## Edge Cases87- For ML workloads with GPU, use NVIDIA runtime and GPU resource scheduling88- For legacy apps, consider init containers for migration scripts89- If team is new to K8s, start with managed services (Fargate, Cloud Run)90- For stateful workloads, evaluate operators (e.g., PostgreSQL operator)
ashutoshsrivastava17