Containerization (Docker)

Containerization is a modern approach to virtualization at the operating system level, in which applications and all their dependencies (libraries, configuration files, environment variables, system utilities) are packaged into isolated containers. Unlike classical virtualization, where each virtual machine includes a full-fledged guest OS with its own kernel, containers use the shared kernel of the host operating system, which makes them much lighter, faster and more economical in terms of resource consumption. The de facto standard in the containerization world is the Docker platform, which provides tools for creating (docker build), delivering (docker push/pull), deploying (docker run/compose) and managing containers. For orchestrating containers on an industrial scale, Kubernetes (k8s) is used, which automates deployment, scaling, load balancing and lifecycle management of container applications. Containerization technology has become an integral part of the DevOps culture and modern software development, ensuring reproducibility of environments from the developer's laptop to production.

How containers work

A container uses Linux kernel mechanisms — namespaces for isolating processes, file system, network, users, IPC and host, as well as control groups (cgroups) for limiting and accounting for consumed resources (CPU, memory, disk I/O, network). A container image (Docker image) is a read-only template consisting of a stack of layers, each of which represents a set of file changes (the difference between two successive states). This layered approach allows efficiently using disk space: common base layers (for example, the Ubuntu or Alpine Linux operating system layer) are stored in a single instance on the host and are used by all containers created on their basis. When a container is started, a thin writeable layer (container layer) is created on top of the read-only layers, where the changes made by the running application are recorded. The virtualization technology underlies the operation of modern orchestration platforms that automate the deployment and scaling of container applications. Russian companies actively use containerization to speed up the development and implementation of new services. The Sintezm product of the Fintech company can be deployed in a container environment for flexible automation of business processes.

Advantages of containerization for business and development

Containerization gives developers and administrators a number of critical advantages. The main one is environment reproducibility: an application packaged in a container with all dependencies will work identically on the developer's laptop, test server and in the production environment, which completely eliminates the "it works on my machine" problem and the associated release delays. Containers start in seconds (versus minutes for VMs), which is ideal for a microservice architecture, where the application is divided into dozens and hundreds of small services. Application scaling becomes trivial and automatic: when the load increases, additional container instances are launched, and when it decreases, they are stopped (auto-scaling). Containers significantly simplify CI/CD processes (continuous integration and delivery): each pipeline stage — compilation, unit testing, integration testing, image build, publication to the registry, deployment — is performed in containers, which ensures full automation and reliability. Isolation at the container level allows safely running several applications with different (and even conflicting) dependencies on one host. From an economic point of view, containerization allows increasing the density of application placement on servers by 3-5 times compared to VMs, which reduces infrastructure costs.

Application in Russian companies and the Kubernetes ecosystem

In Russia, containerization is widely used both in commercial and state IT projects. The Kubernetes platform (including domestic distributions) is the standard for container orchestration. During implementation, it is necessary to take into account the requirements of regulators, especially for critical information infrastructure (CII) facilities. In such cases, the use of certified container environment protection tools, scanning of images for vulnerabilities (Trivy, Clair), configuration of security policies (Pod Security Policies, OPA/Gatekeeper) and logging of all actions is required. For Russian customers, certified Kubernetes distributions included in the register of domestic software are available. The specialists of the Fintech company help customers design and implement a container infrastructure, ensure its security and integration with existing systems, including storage, monitoring and backup systems, as well as conduct training of development and operation teams.