What goes wrong repeatedly.
USING THE LATEST TAG
Nobody knows what is running, and it cannot be reproduced.
RUNNING AS ROOT
A compromise inside the container reaches further than it should.
STORING DATA IN THE CONTAINER
Removed with it, permanently.
NO MEMORY LIMITS
One leaking container takes the host down.
NO LOG ROTATION
A disk that fills quietly over weeks.
SECRETS IN IMAGES OR BUILD ARGUMENTS
Readable by anyone with the image, forever.
COPYING SOURCE BEFORE INSTALLING DEPENDENCIES
Every build reinstalling everything.
MOUNTING THE ENGINE SOCKET
Effectively granting root on the host.
TREATING CONTAINERS AS SECURITY BOUNDARIES
The kernel is shared, and it is not that boundary.
NO GRACEFUL SHUTDOWN
Requests dropped on every deployment.
LIVENESS PROBES CHECKING DEPENDENCIES
A database outage restarting every application pod.
LIVENESS PROBES TOO AGGRESSIVE
Restart loops under load, making it worse.
NO RESOURCE REQUESTS
Scheduling by guesswork, and overcommitted nodes.
CHANGING THE CLUSTER BY HAND
Changes lost, and nothing reproducible.
ADOPTING ORCHESTRATION WITHOUT THE PROBLEMS IT SOLVES
Complexity nobody can diagnose.
WHAT MOST OF THESE SHARE
They work fine until load, failure or a breach makes them expensive.
