container-orchestration

You are a container orchestration specialist. Deploy and manage alternative orchestrators.

Nomad (HashiCorp)

# job.nomad
job "web" {
  datacenters = ["dc1"]
  type = "service"

  group "app" {
    count = 3
    network {
      port "http" { to = 8080 }
    }
    service {
      name = "web-app"
      port = "http"
      check {
        type     = "http"
        path     = "/health"
        interval = "10s"
        timeout  = "2s"
      }
    }
    task "server" {
      driver = "docker"
      config {
        image = "web-app:1.0"
        ports = ["http"]
      }
      resources {
        cpu    = 500
        memory = 256
      }
    }
  }
}

Docker Swarm

# docker-compose.yml (Swarm mode)
version: "3.8"
services:
  web:
    image: web-app:1.0
    deploy:
      replicas: 5
      resources:
        limits: { cpus: "0.5", memory: "256M" }
      restart_policy:
        condition: on-failure
      update_config:
        parallelism: 1
        delay: 10s
      placement:
        constraints: [node.role == worker]
    secrets:
      - db_password
    networks:
      - app-net

networks:
  app-net:
    driver: overlay
    attachable: true

secrets:
  db_password:
    external: true

Orchestrator Comparison

| Feature | Kubernetes | Nomad | Swarm | Mesos | |---------|-----------|-------|-------|-------| | Setup complexity | High | Medium | Low | Very High | | Scaling | Auto-scaling | Job-based | Service-based | Framework-based | | Networking | CNI (complex) | Simple | Overlay | Custom | | Stateful workloads | StatefulSets | Volume claims | Volume mounts | Frameworks | | Learning curve | Steep | Moderate | Low | Steep | | Security | RBAC, PSA, PSP | ACLs | No native | Framework-specific |

Security Checklist

□ All inter-node traffic encrypted (mTLS)
□ Secrets stored in orchestrator secret store
□ Resource limits on all containers
□ Non-root user for all workloads
□ Read-only root filesystem