Cloud Application Deployment

If you're in IT and haven't embraced Docker yet, you're missing a crucial piece of the modern development puzzle. What is Docker? Docker is an open-source platform that automates the deployment, scaling, and management of applications using containerization. It allows you to package an application with all its dependencies into a standardized unit for software development and deployment. Key Concepts: 1. Containers    - Lightweight, standalone executable packages    - Include everything needed to run an application    - Ensure consistency across different environments 2. Images    - Read-only templates used to create containers    - Built from layers, each representing an instruction in the Dockerfile    - Can be shared via Docker Hub or private registries 3. Dockerfile    - Text file containing instructions to build a Docker image    - Defines the environment inside the container    - Automates the image creation process 4. Docker Compose    - Tool for defining and running multi-container Docker applications    - Uses YAML files to configure application services    - Simplifies complex setups with a single command 5. Docker Swarm    - Native clustering and scheduling tool for Docker    - Turns a pool of Docker hosts into a single, virtual host    - Enables easy scaling and management of containerized applications Benefits of Docker: • Consistency: "It works on my machine" becomes a thing of the past • Isolation: Applications and their dependencies are separated from the host system • Efficiency: Lightweight containers share the host OS kernel, reducing overhead • Portability: Containers can run anywhere Docker is installed • Scalability: Easy to scale applications horizontally by spinning up new containers Best Practices: 1. Keep images small and focused 2. Use multi-stage builds to optimize Dockerfiles 3. Leverage Docker Compose for local development 4. Implement proper logging and monitoring 5. Regularly update base images and dependencies 6. Use volume mounts for persistent data 7. Implement proper security measures (e.g., least privilege principle) Getting Started: 1. Install Docker on your machine 2. Familiarize yourself with basic commands (docker run, build, pull, push) 3. Create your first Dockerfile and build an image 4. Experiment with Docker Compose for multi-container setups 5. Explore Docker Hub for pre-built images and inspiration Docker has become an essential skill for developers and operations teams alike. Its ability to streamline development workflows, improve deployment consistency, and enhance scalability makes it a crucial tool in modern software development. Have I overlooked anything? Please share your thoughts—your insights are priceless to me.

Even 𝗡𝗩𝗜𝗗𝗜𝗔 𝗡𝗜𝗠 𝗶𝘀 𝗿𝘂𝗻𝗻𝗶𝗻𝗴 𝗼𝗻 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀, what is 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀 and why is it worth learning 𝗮𝘀 𝗠𝗟𝗢𝗽𝘀/𝗠𝗟/𝗗𝗮𝘁𝗮 𝗘𝗻𝗴𝗶𝗻𝗲𝗲𝗿? Today we look into the Kubernetes system from a bird's eye view. 𝗦𝗼, 𝘄𝗵𝗮𝘁 𝗶𝘀 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀 (𝗞𝟴𝘀)? 𝟭: It is a container orchestrator that performs the scheduling, running and recovery of your containerised applications in a horizontally scalable and self-healing way. Kubernetes architecture consists of two main logical groups: 𝟮: Control plane - this is where K8s system processes that are responsible for scheduling workloads defined by you and keeping the system healthy live. 𝟯: Worker nodes - this is where containers are scheduled and run. 𝗛𝗼𝘄 𝗱𝗼𝗲𝘀 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀 𝗵𝗲𝗹𝗽 𝘆𝗼𝘂? 𝟰: You can have thousands of Nodes (usually you only need tens of them) in your K8s cluster, each of them can host multiple containers. Nodes can be added or removed from the cluster as needed. This enables unrivaled horizontal scalability. 𝟱: Kubernetes provides an easy to use and understand declarative interface to deploy applications. Your application deployment definition can be described in yaml, submitted to the cluster and the system will take care that the desired state of the application is always up to date. 𝟲: Users are empowered to create and own their application architecture in boundaries pre-defined by Cluster Administrators. ✅ In most cases you can deploy multiple types of ML Applications into a single cluster, you don’t need to care about which server to deploy to - K8s will take care of it. ✅ You can request different amounts of dedicated machine resources per application. ✅ If your application goes down - K8s will make sure that a desired number of replicas is always alive. ✅ You can roll out new versions of the running application using multiple strategies - K8s will safely do it for you. ✅ You can expose your ML Services for other Product Apps to use with few intuitive resource definitions. ✅ … ❗️Having said this, while it is a bliss to use, usually the operation of Kubernetes clusters is what is feared. It is a complex system. ❗️Master Plane is an overhead, you need it even if you want to deploy a single small application. Are you deploying your ML applications in Kubernetes? What are the main pain points you are facing? Let me know in the comments 👇 #MachineLearning #GenAI #LLM #LLMOps

Performance-Fresser Series — Today: Kubernetes Kubernetes was built to orchestrate Google's global infrastructure. You are not Google. Terribly sorry. 82% of container users run Kubernetes in production. Most of them shouldn't. ■ The Control Plane Tax Before your application serves a single request, Kubernetes requires etcd (2-8 GB RAM per node), kube-apiserver, kube-scheduler, kube-controller-manager, kubelet (reserves 25% of node memory), CoreDNS, kube-proxy, and a CNI plugin. A production HA cluster: 6-12 CPU cores, 12-24 GB RAM. For orchestration. Not for your code. K3s, the "lightweight" alternative, still needs 1.6 GB RAM at idle. The lightest Kubernetes is heavier than most applications it runs. Marvellous. ■ The YAML Labyrinth One service on Kubernetes: Deployment (20 lines) + Service (19 lines) + Ingress (27 lines) = 66 lines across 3 files. Minimum. The same on FreeBSD: one rc.conf entry. On Linux: one 10-line service file. Production services average 200+ lines of YAML. Per service. ■ The Waste Report (Cast.ai 2024, 2,100+ organisations) → Average CPU utilisation: 10% → Average memory utilisation: 23% → 87% of provisioned CPU sits idle You are paying for 10 servers to do the work of one. Quite the bargain. ■ The Operational Sinkhole (Komodor 2025) → 38% of companies: high-impact outages weekly → 79% of incidents: triggered by a recent change → Platform teams lose 34 workdays per year on troubleshooting Kubernetes doesn't reduce operational complexity. It adds another layer. You still deploy your application. Now you also maintain the platform that deploys your application. ■ The Invoice → Amazon Prime Video: 90% cost reduction by returning to a monolith → 37signals: $3.2M/year to $1.3M/year. $10M+ saved over five years → GEICO: decade-long cloud migration. Result: 2.5x higher costs The pattern: adopt, discover the tax, quietly move back. ■ The Staffing Multiplier One documented case: 12 DevOps engineers reduced to 3 after leaving Kubernetes. Nine were maintaining the platform, not building the product. When your orchestration layer requires more engineers than your application, one might consider that rather telling. ■ The Certification Economy CKA: $445 per engineer. With training: up to $1,950. Team of five: nearly $10K. Before writing a single line of application code. The complexity isn't a bug. It's a business model. ■ Who Actually Needs It Kelsey Hightower, one of its most prominent advocates: "There's a lot of extra concepts, config files, and infrastructure you have to manage to do something basic." If its greatest champion calls it challenging, perhaps it is. Kubernetes makes sense for 50+ services across multiple regions with a dedicated platform team. That describes perhaps 5% of companies running it. The other 95% need a server, a process manager, and the courage to admit it. #PerformanceFresser #Kubernetes #DevOps #CloudNative #Infrastructure

Using unverified container images, over-permissioning service accounts, postponing network policy implementation, skipping regular image scans and running everything on default namespaces…. What do all these have in common ? Bad cybersecurity practices! It’s best to always do this instead; 1. Only use verified images, and scan them for vulnerabilities before deploying them in a Kubernetes cluster. 2. Assign the least amount of privilege required. Use tools like Open Policy Agent (OPA) and Kubernetes' native RBAC policies to define and enforce strict access controls. Avoid using the cluster-admin role unless absolutely necessary. 3. Network Policies should be implemented from the start to limit which pods can communicate with one another. This can prevent unauthorized access and reduce the impact of a potential breach. 4. Automate regular image scanning using tools integrated into the CI/CD pipeline to ensure that images are always up-to-date and free of known vulnerabilities before being deployed. 5. Always organize workloads into namespaces based on their function, environment (e.g., dev, staging, production), or team ownership. This helps in managing resources, applying security policies, and isolating workloads effectively. PS: If necessary, you can ask me in the comment section specific questions on why these bad practices are a problem. #cybersecurity #informationsecurity #softwareengineering

Let's 𝗱𝗲𝗽𝗹𝗼𝘆 a REST API to 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀 🐳 Step by step ↓ 𝗧𝗵𝗲 𝗽𝗿𝗼𝗯𝗹𝗲𝗺 🤔 Two weeks ago we built a REST API to serve historical data on taxi rides in NYC. And last week we wrote a professional Dockerfile to package it inside a Docker image. The API works like a charm on our laptop, but the thing is, until you don’t deploy it to a production environment, and make it accessible to > your clients 💁🏻♀️ > your colleagues 👨🏻💼 > or even the whole world 🌏 your real-world impact is ZERO. So today, I want to show you how to deploy this API to a Kubernetes cluster. 𝗪𝗵𝗮𝘁 𝗶𝘀 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀? ☸📦 Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of your Dockerized apps. Kubernetes is a powerful beast. However, it has also one BIG problem.. 𝗧𝗵𝗲 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀 𝗬𝗔𝗠𝗟 𝗛𝗘𝗟𝗟 🔥 The Kubernetes configuration file required to deploy even the simplest service is > very verbose, > error-prone and > excessively complex. which adds too much friction (and frustration!) in your deployment process. So the question is >> 𝗜𝘀 𝗶𝘁 𝗽𝗼𝘀𝘀𝗶𝗯𝗹𝗲 𝘁𝗼 𝗱𝗲𝗽𝗹𝗼𝘆 𝘁𝗼 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀, 𝘄𝗶𝘁𝗵𝗼𝘂𝘁 𝗴𝗼𝗶𝗻𝗴 𝘁𝗵𝗿𝗼𝘂𝗴𝗵 𝗬𝗔𝗠𝗟 𝗵𝗲𝗹𝗹? Yes, it is! ⬇️ 𝗚𝗶𝗺𝗹𝗲𝘁 𝘁𝗼 𝘁𝗵𝗲 𝗿𝗲𝘀𝗰𝘂𝗲 🦸🏻 Gimlet  ↳🔗 https://gimlet.io/ is a tool running inside your Kubernetes cluster that helps you quickly deploy your apps. Let's start with a manual deployment: 𝗠𝗮𝗻𝘂𝗮𝗹 𝗱𝗲𝗽𝗹𝗼𝘆𝗺𝗲𝗻𝘁 🔧 These are the steps to create a new deployment with the Gimlet UI > 𝗜𝗺𝗽𝗼𝗿𝘁 your github repository. > Choose to manually deploy from a 𝗗𝗼𝗰𝗸𝗲𝗿𝗳𝗶𝗹𝗲 > Pick your 𝗗𝗼𝗰𝗸𝗲𝗿 𝗿𝗲𝗴𝗶𝘀𝘁𝗿𝘆, and > Set the 𝗽𝗼𝗿𝘁 𝗻𝘂𝗺𝗯𝗲𝗿 your API is listening to. BOOM! Your API is now running in Kubernetes. Let's go one step further... 𝗔𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗰 𝗱𝗲𝗽𝗹𝗼𝘆𝗺𝗲𝗻𝘁𝘀 𝘄𝗶𝘁𝗵 𝗖𝗜/𝗖𝗗 ⚙️ The Gimlet Github action helps you automatically deploy your code changes to your Kubernetes cluster. For example, you can add a github workflow that > 𝗧𝗿𝗶𝗴𝗴𝗲𝗿𝘀 after every push to main branch > 𝗧𝗲𝘀𝘁𝘀 your code > 𝗕𝘂𝗶𝗹𝗱𝘀 and pushes the Docker image to your Docker registry (in this case, I use mine from Github), and > 𝗗𝗲𝗽𝗹𝗼𝘆𝘀 it to Kubernetes using the Gimlet action. Continuous delivery made simple! 𝗙𝘂𝗹𝗹 𝘀𝗼𝘂𝗿𝗰𝗲 𝗰𝗼𝗱𝗲 👨💻 Below you will find a link to the Github repository will all the code ⬇️ ---- Hi there! It's Pau Labarta Bajo 👋 Every day I share free, hands-on content, on production-grade ML, to help you build real-world ML products. 𝗙𝗼𝗹𝗹𝗼𝘄 𝗺𝗲 and 𝗰𝗹𝗶𝗰𝗸 𝗼𝗻 𝘁𝗵𝗲 🔔 so you don't miss what's coming next #machinelearning #docker #kubernetes #mlops #realworldml

I've broken more Kubernetes clusters than I’d like to admit. Probably 500+ times in the last 13 years. So here are 13 real mistakes I’ve made in production and what I do differently now. 1. replicas: 1 in production. (One node died. So did our app.) Now: Minimum 2 replicas for everything customer-facing. Always. 2. Forgot readinessProbe. (Traffic hit cold containers. Result: timeouts.) Now: Every service gets a basic HTTP check. No exceptions. 3. Used :latest as the image tag. (Deployment pulled the wrong build mid-rollout.) Now: Every image is pinned + SHA verified in CI. 4. Didn’t set resources.requests. (Pod got evicted under load.) Now: We baseline every workload and bake it into Helm. 5. Set only limits without requests. (Burstable QoS. Crashed when the node got noisy.) Now: requests and limits are always paired. 6. Mounted full ConfigMap without subPath. (A config reload restarted everything.) Now: Only mount the files we need. Nothing else. 7. No terminationGracePeriodSeconds. (App got killed mid-request.) Now: We measure shutdown time and tune accordingly. 8. Hardcoded hostPort. (Multi-tenant cluster blew up.) Now: No hostPort unless strictly necessary. 9. Skipped liveness probes. (Hung processes sat “healthy” for hours.) Now: Every app with state gets a liveness probe. 10. Ignored kubectl get events. (Missed critical CNI errors for hours.) Now: Events are always step 2 after describing. 11. Assumed HPA = auto-healing. (HPA scaled replicas but rollout broke one-by-one.) Now: We separate recovery logic from autoscaling logic. 12. Forgot to set revisionHistoryLimit. (Old ReplicaSets flooded the cluster.) Now: We cap every Deployment’s history to 3 versions. 13. No resource quota in non-prod. (Someone spun up 50 pods in dev. Took down the cluster.) Now: Every namespace gets a budget. So, what’s the most painful mistake you’ve ever made in Kubernetes? Love to read in the comments.

Here’s a quick breakdown of Kubernetes deployment strategies you should know — and the trade-offs that come with each. But first — why does this matter? Because deploying isn’t just about pushing new code — it’s about how safely, efficiently, and with what level of risk you roll it out. The right strategy ensures you deliver value without breaking production or disrupting users. Let's dive in: 1. Canary ↳ Gradually route a small percentage of traffic (e.g. 20%) to the new version before a full rollout. ↳ When to use ~ Minimize risk by testing updates in production with real users. Downtime: No Trade-offs: ✅ Safer releases with early detection of issues ❌ Requires additional monitoring, automation, and traffic control ❌ Slower rollout process 2. Blue-Green ↳ Maintain two environments — switch all traffic to the new version after validation. ↳ When to use ~ When you need instant rollback options with zero downtime. Downtime: No Trade-offs: ✅ Instant rollback with traffic switch ✅ Zero downtime ❌ Higher infrastructure cost — duplicate environments ❌ More complex to manage at scale 3. A/B Testing ↳ Split traffic between two versions based on user segments or devices. ↳ When to use ~ For experimenting with features and collecting user feedback. Downtime: Not Applicable Trade-offs: ✅ Direct user insights and data-driven decisions ✅ Controlled experimentation ❌ Complex routing and user segmentation logic ❌ Potential inconsistency in user experience 4. Rolling Update ↳ Gradually replace old pods with new ones, one batch at a time. ↳ When to use ~ To update services continuously without downtime. Downtime: No Trade-offs: ✅ Zero downtime ✅ Simple and native to Kubernetes ❌ Bugs might propagate if monitoring isn’t vigilant ❌ Rollbacks can be slow if an issue emerges late 5. Recreate ↳ Shut down the old version completely before starting the new one. ↳ When to use ~ When your app doesn’t support running multiple versions concurrently. Downtime: Yes Trade-offs: ✅ Simple and clean for small apps ✅ Avoids version conflicts ❌ Service downtime ❌ Risky for production environments needing high availability 6. Shadow ↳ Mirror real user traffic to the new version without exposing it to users. ↳ When to use ~ To test how the new version performs under real workloads. Downtime: No Trade-offs: ✅ Safely validate under real conditions ✅ No impact on end users ❌ Extra resource consumption — running dual workloads ❌ Doesn’t test user interaction or experience directly ❌ Requires sophisticated monitoring Want to dive deeper? I’ll be breaking down each k8s strategy in more detail in the upcoming editions of my newsletter. Subscribe here → tech5ense.com Which strategy do you rely on most often? • • • If you found this useful.. 🔔 Follow me (Vishakha) for more Cloud & DevOps insights ♻️ Share so others can learn as well!

What’s going on, y'all! 👋 I’m excited to announce that the documentation supporting the video I released with the Cloud Security Podcast — "How To Setup A DevSecOps Pipeline for Amazon EKS with Terraform" — has been released! 🎊 🥳 You can check out the full docs on The DevSec Blueprint (DSB) in the Projects section here: https://lnkd.in/gq-t8hSG Here’s a quick rundown of what you can learn below: ✅ Secure CI/CD Architecture: Combine AWS CodePipeline, CodeBuild, S3, SSM Parameter Store, and EKS for a seamless, end-to-end workflow. ✅ Integrated Security Scanning: Embed Snyk and Trivy checks directly into your pipeline to catch vulnerabilities before production. ✅ Infrastructure as Code: Leverage Terraform for consistent, scalable provisioning and easier infrastructure management. ✅ Containerized Deployments with EKS: Gain confidence deploying Kubernetes workloads to EKS, ensuring effortless scaling and orchestration. ✅ Proper Secrets Management: Use AWS Systems Manager Parameter Store to securely handle sensitive data, following best practices every step of the way. Check it out if you're looking to build cloud-native DevSecOps pipelines within AWS!

Feature flags help us ship with trust. I've talked about how feature flags are a way to move faster before. For us, they are just as much about releasing more calmly and making better product decisions. Here’s how we usually use them at awork: First, we enable a change in our own internal workspace. That gives us a safe environment to see how something behaves in real workflows, not just in test cases. Then we open it up to a small group of early users. This is often where the most useful feedback comes in, because people show you the edge cases, confusing moments, and unexpected habits you can’t fully predict upfront. After that, we roll features out progressively: - first to selected workspaces - then to new workspaces, so people don’t have to learn both the old and the new way during their trial - and only later to larger customers, where reliability matters even more and the blast radius is bigger. This also gives them time to prepare, adjust internal processes, and inform their teams before we make the change for everyone What I like about this approach is that it protects both speed and quality. We can keep delivery moving without turning releases into high-stress moments for customers or the team. We’ve also built internal tooling around this, which helps a lot with visibility and clarity across product and engineering, but also customer-facing teams like onboarding and success. On top of that, we use awork internally to make the status of each feature visible, so everyone can see where something is in the rollout process and what that means for customers. Instead of treating flags as temporary hacks, we can manage rollouts deliberately and make better decisions together. That matters more than it sounds. Good rollout infrastructure creates better conversations, better feedback loops, and ultimately more trust in every release. Have you built your own rollout process too? #engineering #featureflags #productdevelopment #saas #hybridwork