Tag
Kubernetes won the orchestration battle, but Docker Swarm stays maintained inside Docker Engine and makes real sense for small teams without dedicated SRE, self-hosted stacks on 1-5 VPS, and edge mini-clusters. In those contexts, Swarm's minimal learning curve and low operational cost outweigh Kubernetes's advanced features.
Portainer is the reference web UI for managing Docker containers, Compose stacks, and Swarm/Kubernetes clusters. Step-by-step guide with a modern compose.yaml, HTTPS on port 9443, a named volume, and optional Traefik configuration for self-hosting.
Con 1.34 liberado en agosto de 2025 y el ciclo de 1.35 en su última fase de congelación de funciones, qué llegará estable, qué quedará en beta, qué nos interesa a quienes mantenemos clústeres pequeños o medianos y qué podemos ignorar sin culpa hasta el siguiente ciclo.
gVisor interpone un kernel en espacio de usuario entre el contenedor y el anfitrión. Después de años en producción en Google y adopción creciente en plataformas serverless, merece una lectura honesta sobre cuándo compensa frente a microVMs y runtimes clásicos.
Fly.io has spent years selling the idea that deploying an application across several regions should be almost as simple as pushing an image and writing one config line. After several real projects on the platform, here is an honest read on what it delivers, what is missing, and who it is worth choosing over more classic options.
Wolfi turned three as a public project and has become the base for Chainguard container images and much of the industry chasing clean software supply chains. A field-tested review of what it offers against Alpine and Debian slim.
Kubernetes 1.34 ships with Dynamic Resource Allocation (DRA) graduating to stable, scheduler improvements, and CEL-based mutating admission policies that replace webhooks. A practical rundown of what is safe to upgrade now, what can wait, and what actually changes for teams running production clusters.
Six months after containerd 2.0 reached general availability there is enough real-world mileage to judge the migration from the 1.x branch in production. We cover what changes in the config file, what breaks on Kubernetes and Docker Swarm, and when planning the jump actually pays off.
Kubernetes 1.32 Penelope shipped in December and has been running in clusters for several months. It is a good time to look at which changes have aged well, which created extra work, and what lessons to carry into the jump to 1.33.
Kubernetes 1.33 (Octarine) lands April 23. In-place pod resize moves to beta and ships on by default, sidecar containers finally reach GA, and several endpoint and security deprecations arrive that operators should review before upgrading from 1.32.
cAdvisor is still embedded in kubelet and covers surface metrics, but falls short for production Kubernetes. The modern minimum stack pairs it with kube-state-metrics, node-exporter, Prometheus, and Grafana as a base, eBPF for deep network and syscall visibility, and OpenTelemetry for application context.
Containerising SCADA makes sense for the upper architecture layers: HMI, historians, and data gateways. PLCs still control hardware with hard determinism. The biggest risk is cultural: applying DevOps patterns without adapting to OT context causes incidents. NIS2 requires managing containers as any other critical infrastructure asset.
Podman is the Docker alternative with no central daemon and no root privileges required. Each container runs as a direct child process of the launching user, with rootless support since version 1.0 in 2019. If a container escapes, it does not gain host root. When Podman makes sense and what real differences to expect.
Trivy and Grype are the two leading open-source tools for container image scanning in CI/CD pipelines. Both detect CVEs in OS packages and language dependencies with less than 5% coverage difference. Trivy stands out for IaC scanning; Grype natively integrates the SBOM workflow with Syft.
nerdctl is a Docker-compatible CLI that talks directly to containerd, the standard Kubernetes runtime since dockershim was removed in 2022. It adds rootless support by default, encrypted images with ocicrypt, lazy-pulling, and native CNI. It fits best where containerd already runs, though Docker Engine still wins on advanced Compose and Swarm.
Kubernetes 1.28 introduces native sidecar containers in alpha via KEP-753: adding restartPolicy Always to initContainers ensures correct startup and shutdown ordering. It fixes Jobs that never terminate. Istio, Linkerd, and observability agents like Fluent Bit are the primary beneficiaries.
Docker is the most widely used container platform. This guide explains how to install it on Ubuntu 24.04 LTS from the official repository, using the GPG key signed under /etc/apt/keyrings and the bundled Compose plugin.
Traefik installs with Docker Compose by creating a working directory, an acme.json file with 600 permissions for certificates, and a traefik.yml with the Docker provider enabled. The container starts with docker-compose up -d, discovers services through labels, and handles TLS via Let's Encrypt with no extra manual steps.
Docker Compose is Docker's official tool for defining and running multi-container applications with a YAML file: one command spins up every service, network, and volume it describes. On Ubuntu 20.04 it is installed by downloading the standalone binary from GitHub, though Docker recommends moving to the v2 CLI plugin, since v1 is no longer maintained.
To install Docker on Ubuntu 20.04, add Docker's own repository (not Ubuntu's, which tends to lag behind), import its GPG key, install the docker-ce package, and add your user to the docker group so you can run containers without sudo. Running docker run hello-world at the end confirms the daemon works.
