# container A method for packaging and securely running an application within an application virtualization environment. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Stop Treating CSS Container Queries Like Traditional Media Queries DevFeed: [Stop Treating CSS Container Queries Like Traditional Media Queries]() Original publisher: [Read original article]() Author: hello@smashingmagazine.com (Victor Ayomipo) Published: 2026-09-16T13:00:00Z Content type: article Language: en Sources: [Articles on Smashing Magazine -- For Web Designers And Developers]() Topics: [container](), [CSS](), [Media Queries](), [Responsive Design]() Tags: [container](), [css](), [responsive-design](), [techniques]() ### AI overview This article explains why CSS container queries should not be treated as equivalent to traditional media queries. It discusses their differing purposes, focuses on container size queries, and describes how they allow reusable components to respond to the size of their surrounding container. ### Source excerpt Despite broad browser support, container queries remain surprisingly underused and frequently misunderstood. Let's look at how they differ from media queries, when to reach for each, and how container queries help reusable components respond naturally to the contexts in which they appear. - CSS - Tools - Techniques ## fsGroupChangePolicy: OnRootMismatch and the setgid Invariant That Makes It Sound DevFeed: [fsGroupChangePolicy: OnRootMismatch and the setgid Invariant That Makes It Sound]() Original publisher: [Read original article]() Author: Philipp Lehmann (philipp.lehmann@gruppe.ai) Published: 2026-09-11T07:00:00Z Content type: tutorial Language: en Sources: [Philipp Lehmann]() Topics: [container](), [mount](), [Security](), [Process]() Tags: [container](), [container-image](), [kubernetes](), [mount](), [network](), [performance](), [reliability](), [security](), [stateful](), [storage](), [waiting]() ### AI overview This article explains why a stateful pod can remain in ContainerCreating for fifteen minutes when fsGroup triggers a recursive chown across a large network-backed volume. It describes how fsGroupChangePolicy: OnRootMismatch can skip the recursive walk when the volume root group already matches, and discusses the setgid invariant that supports this behavior. ### Source excerpt Pod stuck in ContainerCreating from fsGroup recursive chown: fsGroupChangePolicy: OnRootMismatch, and why the setgid bit on the volume root makes it safe. ## Java JVM CPU and Memory Requests and Limits in Kubernetes DevFeed: [Java JVM CPU and Memory Requests and Limits in Kubernetes]() Original publisher: [Read original article]() Author: Gulcan Topcu Published: 2026-08-31T00:00:00Z Content type: tutorial Language: en Sources: [Learnk8s]() Topics: [Kubernetes](), [Java](), [container](), [cpu]() Tags: [container](), [cpu](), [docker](), [garbage-collection](), [java](), [kubernetes](), [memory]() ### AI overview This tutorial explains how Kubernetes CPU and memory requests and limits affect Java JVM behavior. It covers container memory sizing, heap usage, garbage collection, CPU-derived JVM settings, and testing under load. ### Source excerpt Setting Kubernetes CPU and memory requests and limits for a JVM service is four coupled decisions: container memory, heap size, GC selection, and CPU quota. Use the calculator to explore the space. ## How fast is C++26's std::hive? DevFeed: [How fast is C++26's std::hive?]() Original publisher: [Read original article]() Author: Daniel Lemire Published: 2026-08-02T17:00:10Z Content type: article Language: en Sources: [Daniel Lemire]() Topics: [container](), [Data structures](), [cpu](), [intel]() Tags: [compiler](), [container](), [data-structure](), [intel](), [processor](), [standard-library]() ### AI overview The article benchmarks a C++26 std::hive implementation against vector, list, and another container. In the reported tests, hive insertion costs about twice as much as vector insertion, while iteration is about eight times slower than vector and no faster than linked-list iteration. ### Source excerpt C++26 adds a new container to the standard library: std::hive. It is meant to occupy the ground between std::vector and std::list. Like a vector, it keeps its elements in contiguous blocks of memory, so scanning it does not require you to chase a pointer for every element. Like a list, it never moves an element ... Continue reading How fast is C++26's std::hive? ## Docker: guía práctica de contenedores en Linux DevFeed: [Docker: guía práctica de contenedores en Linux]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-08-02T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [Docker](), [Linux](), [Docker Compose](), [Dockerfile](), [container](), [Command-line interface](), [Kernel]() Tags: [cgroups](), [cli](), [compose](), [container](), [debian](), [distro](), [docker](), [docker-compose](), [dockerignore-usage](), [kernel](), [linux](), [oci](), [podman](), [python]() ### AI overview A practical Spanish-language guide to Docker on Linux. It explains container isolation through Linux namespaces and cgroups, installation on Ubuntu/Debian, Docker architecture, image layers and Dockerfiles, and introduces networks, volumes, Docker Compose, and security practices. ### Source excerpt Guía práctica de Docker: arquitectura, capas de imagen, redes, volúmenes, Docker Compose y buenas prácticas de seguridad, con ejemplos reales. ## Extract Text from Your PDF and Image Files with Apache Tika DevFeed: [Extract Text from Your PDF and Image Files with Apache Tika]() Original publisher: [Read original article]() Author: Nic Raboy Published: 2026-06-13T00:45:07Z Content type: tutorial Language: en Sources: [Nic Raboy]() Topics: [Docker Compose](), [Docker](), [container](), [AI search]() Tags: [ai](), [browser](), [command-line](), [container](), [docker](), [how-to](), [image](), [pdf](), [rag](), [services](), [xml]() ### AI overview This tutorial explains how to deploy Apache Tika with Docker or Docker Compose and use it to extract text from PDF, image, and other document formats. The extracted text can provide plaintext context for local AI tools and RAG workflows. ### Source excerpt With AI becoming increasingly popular in everything, and retrieval-augmented generation (RAG) becoming a requirement in everyone's organization, how you're providing context to the AI tools becomes im... The post Extract Text from Your PDF and Image Files with Apache Tika appeared first on The Polyglot Developer. ## Kubelet Metrics: How cAdvisor and CRI Collect Kubernetes Stats DevFeed: [Kubelet Metrics: How cAdvisor and CRI Collect Kubernetes Stats]() Original publisher: [Read original article]() Author: Gulcan Topcu Published: 2026-05-18T00:00:00Z Content type: tutorial Language: en Sources: [Learnk8s]() Topics: [Kubernetes](), [container](), [telemetry](), [gRPC](), [Kernel]() Tags: [api](), [api-server](), [cgroups](), [collect](), [container](), [cpu](), [data](), [deployment](), [grafana](), [kernel](), [kubernetes](), [linux](), [metrics](), [monitoring](), [performance](), [pipeline](), [prometheus](), [trace](), [visibility]() ### AI overview This tutorial explains how Kubernetes collects and exposes container, pod, and node metrics through kubelet, cAdvisor, the Linux kernel, and the Container Runtime Interface (CRI). It describes the shift toward CRI-native metrics over gRPC and how Prometheus, Grafana, and other observability systems consume the data. ### Source excerpt Learn how kubelet collects Kubernetes metrics from cgroups, cAdvisor, containerd and CRI, and when pod and container stats move to the runtime. ## One Map Key, One Lookup DevFeed: [One Map Key, One Lookup]() Original publisher: [Read original article]() Author: Google Testing Bloggers (noreply@blogger.com) Published: 2026-04-29T12:26:00Z Content type: tutorial Language: en Sources: [Google Testing Blog]() Topics: [Code](), [Optimization](), [cpu](), [C++](), [Go Language](), [Java](), [container]() Tags: [article](), [c-plus-plus](), [code](), [container](), [cpu](), [go](), [java](), [optimization](), [roman-govsheev](), [tech](), [tott]() ### AI overview This Google Tech on the Toilet article explains how checking for a map key and then fetching its value performs redundant work. It recommends retrieving the value once and reusing it, with corresponding idioms in Python, Go, C++, and Java, and discusses avoiding similar check-then-act patterns when counting or initializing values. ### Source excerpt This article was adapted from a Google Tech on the Toilet (TotT) episode. You can download a printer-friendly version of this TotT episode and post it in your office. By Roman Govsheev Can you spot the wasted CPU cycles in the map usage? if employee_id in employees: mail_to(employees[employee_id].email_address) The redundant lookup caused the waste by performing a check (in) and a fetch ([]) as two separate operations when one is sufficient. Every lookup involves a cost--whether it's computing a hash and scanning buckets or performing an O(log n) traversal. These costs add up quickly. But avoiding them isn't just "premature optimization"--it's about writing cleaner, more robust code that stays efficient at scale and prevents potential race conditions. Instead of paying this cost twice, perform the lookup once and reuse the result: if (employee := employees.get(employee_id)) is not None: mail_to(employee.email_address) Assigning the search result to a variable avoids a second lookup. This efficiency is native to Go via the "comma ok" idiom (val, ok := map[key]) and C++ using map.find(key), both handling retrieval and existence in a single pass. The same inefficiency applies when counting or initializing default. Stop checking for presence; instead, use idioms that handle missing keys automatically at the container level: The redundant way The efficient way If key not in counts: counts[key] = 1 else: counts[key] += 1 counts = defaultdict(int) # Initializes 0 automatically # ... other logic ... counts[key] += 1 Here are some details depending on which language you use: C++: operator[] returns a reference to the value--automatically inserting a default (like 0) if the key is missing--allowing the increment to happen in place. Java: Use map.computeIfAbsent() to perform retrieval and updates in a single call. This is more concise and, on concurrent collections, has the potential to be thread-safe--preventing the "check-then-act" race conditions common with separate contains an ## Deploying Temporal Workers to Amazon ECS DevFeed: [Deploying Temporal Workers to Amazon ECS]() Original publisher: [Read original article]() Author: Ebenezer Ankrah Published: 2026-04-02T00:00:00Z Content type: tutorial Language: en Sources: [Temporal Blog]() Topics: [Amazon Elastic Container Service](), [Deployment](), [AWS IAM](), [Dockerfile](), [container](), [health checks](), [Amazon Web Services]() Tags: [amazon](), [deployment](), [docker](), [docker-image](), [ecs](), [environment-variables](), [health-checks](), [how-to](), [iam]() ### AI overview A guide to deploying Temporal Workers on Amazon ECS with Fargate. It explains container configuration, health checks, graceful shutdown, task definitions, IAM roles, secret injection through SSM Parameter Store, and outbound connectivity requirements. ### Source excerpt A comprehensive guide to deploying Temporal Workers on Amazon ECS with Fargate. Covers container config, IAM roles, scaling, and cost-saving with Fargate Spot. ## Local, CPU-Friendly, High-Quality TTS (Text-to-Speech) with Kokoro DevFeed: [Local, CPU-Friendly, High-Quality TTS (Text-to-Speech) with Kokoro]() Original publisher: [Read original article]() Published: 2026-04-01T04:42:35Z Content type: tutorial Language: en Sources: [Ariya Hidayat]() Topics: [voice ai](), [container](), [Docker](), [API](), [JavaScript](), [podman](), [Python]() Tags: [api](), [container](), [cpu](), [docker](), [javascript](), [openai](), [podman](), [privacy](), [python](), [speech](), [text-to-speech]() ### AI overview A tutorial on running Kokoro, an 82M-parameter text-to-speech model, locally with speech synthesis performed entirely on the CPU. It explains how to launch Kokoro-FastAPI in Docker or Podman, use its web UI or OpenAI-compatible speech API, run JavaScript and Python examples, select voices, and measure generation speed across CPUs. ### Source excerpt Just a few years ago, realistic local speech generation seemed unimaginable. Today, its quality is exceptional and, crucially, it delivers these results without compromising privacy. ## Bigger Slugs and Greater Build Timeout Flexibility DevFeed: [Bigger Slugs and Greater Build Timeout Flexibility]() Original publisher: [Read original article]() Author: Jesse Brown Published: 2026-03-19T22:28:36Z Content type: release Language: en Sources: [Heroku]() Topics: [Heroku](), [Deployment](), [container]() Tags: [buildpacks](), [deployment](), [developer](), [dynos](), [heroku](), [news](), [platform-updates](), [timeout]() ### AI overview Heroku increased the default maximum compressed app slug size from 500MB to 1GB and raised build compile timeouts. The update supports applications with large dependencies, while larger slugs may increase dyno boot times. ### Source excerpt Modern applications, especially those leveraging AI and data-heavy libraries, need more room to breathe. To support these evolving stacks and reduce developer friction, we've increased the default maximum compressed slug size from 500MB to 1GB. Understanding app slugs and deployment App slugs are the container build artifacts produced by Heroku Buildpacks and run in dynos. [...] The post Bigger Slugs and Greater Build Timeout Flexibility appeared first on Heroku. ## Blog: Falco at KubeCon Europe 2026 -- See You in Amsterdam! 🐦 DevFeed: [Blog: Falco at KubeCon Europe 2026 -- See You in Amsterdam! 🐦]() Original publisher: [Read original article]() Published: 2026-03-18T00:00:00Z Content type: news Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Security](), [Cloud](), [container](), [AI-assisted coding]() Tags: [2026](), [blog](), [cloud-native](), [community](), [conference](), [container](), [europe](), [falco](), [kubecon](), [kubernetes](), [live-event](), [security]() ### AI overview Falco announces its presence at KubeCon + CloudNativeCon Europe 2026 in Amsterdam, including talks, a workshop, booth activities, and a preview of a developing way to run Falco locally so AI coding agents follow new rules. ### Source excerpt We're excited to share that the Falco community will be at KubeCon + CloudNativeCon Europe 2026 in Amsterdam! Whether you're a long-time contributor, a curious user, or just want to say hi, we'd love to see you there. Falco is celebrating 10 years of development and adoption, and we are on the lookout for people who would like to say Happy Birthday to the project or share their best Falco story. Libby Schulze and I will be on the event floor with mic and camera to capture some amazing moments and memories from Falco's 10 years. So bring your best story, and we'll see you at the Falco booth! Sneak peek Psst... we have something really cool brewing that we will show at the Falco booth. You, our amazing reader, is the first to hear about this. It's a way to run Falco locally on your development machine, and make sure your AI coding agents are following new rules that are being defined. We'd love to get your feedback on this as we're currently building it! Here's where you can find us in Amsterdam and everything we have lined up: Project lightning talk Forensics With Falco Speaker: Gerald Combs, Maintainer When: Monday, March 23, 2026 -- 10:27 to 10:32 CET Where: Elicium 2 Falco has recently expanded its capabilities with capture recording, opening the door to seamless integration with forensic analysis tools like Stratoshark. In this lightning talk, Gerald will walk through how the two tools work together to provide deep visibility into container and system activity. He will demonstrate how captured event data can accelerate investigations and discuss key considerations for safely and efficiently deploying these features in production environments. Sysdig-led workshop Hands-On Cloud Native Security Workshop When: Monday, March 23 -- 2:00-4:00 PM CET Run Atomic Red Team™ tests, then step into the Blue Team role to detect threats and create custom Falco™ detection rules in this hands-on 90-minute keyboard workshop. Conference talk In Falco's Nest: The Evolution of Cloud Na ## Code Execution Sandbox for Agents on Heroku DevFeed: [Code Execution Sandbox for Agents on Heroku]() Original publisher: [Read original article]() Author: Anush DSouza Published: 2026-02-17T20:34:33Z Content type: tutorial Language: en Sources: [Heroku]() Topics: [Heroku](), [Code](), [container](), [Model Context Protocol (MCP)](), [Claude]() Tags: [agents](), [claude](), [code](), [container](), [execution](), [heroku](), [heroku-ai](), [managed-inference-and-agents](), [mcp](), [mcp-on-heroku](), [news](), [sandbox]() ### AI overview Heroku describes code execution sandboxes for AI agents, using ephemeral one-off dynos to isolate untrusted code. The article explains built-in and MCP-based integrations and how programmatic tool calling can reduce context usage. ### Source excerpt Large language models are good at writing code. Data from Anthropic shows that allowing Claude to execute scripts, rather than relying on sequential tool calls, reduces token consumption by an average of 37%, with some use cases seeing reductions as high as 98%. Untrusted code needs a secure and isolated place to execute. We solved [...] The post Code Execution Sandbox for Agents on Heroku appeared first on Heroku. ## Kubernetes Memory Limits and Go DevFeed: [Kubernetes Memory Limits and Go]() Original publisher: [Read original article]() Published: 2026-01-27T00:00:00Z Content type: article Language: en Sources: [William Kennedy]() Topics: [Go Language](), [Kubernetes](), [configuration](), [container](), [Testing]() Tags: [configuration](), [container](), [experiment](), [go](), [golang](), [kubernetes](), [load-testing](), [memory](), [performance]() ### AI overview This article examines how Kubernetes memory limits interact with the Go runtime. Through controlled load testing, it investigates how out-of-memory events arise under hard limits and how GOMEMLIMIT, Kubernetes requests, and limits may help align Go services with container memory boundaries. The author notes that the results are experimental and may not apply directly to every service. ### Source excerpt Kubernetes memory limits introduce a subtle but critical interaction with the Go runtime that can determine whether a service runs efficiently or fails under load. This article explores how Go manages memory under normal conditions and what changes when Kubernetes enforces hard memory constraints. Using controlled load testing, it shows why Go is generally excellent at self regulating memory, how OOM events emerge once limits are imposed, and how tools like GOMEMLIMIT can be used to align the runtime with container boundaries. Originally published in July 2024, the guidance remains highly relevant for teams running Go services in containerized environments where stability and throughput are tightly coupled to memory configuration. ## Introducing Multiple Registry Support on DigitalOcean Container Registry DevFeed: [Introducing Multiple Registry Support on DigitalOcean Container Registry]() Original publisher: [Read original article]() Author: Ravish Ahmad Khan Published: 2026-01-09T21:12:58Z Content type: release Language: en Sources: [DigitalOcean]() Topics: [Digital Ocean](), [container](), [Development](), [Kubernetes]() Tags: [announce](), [availability](), [container](), [digitalocean](), [feature](), [kubernetes](), [product-updates](), [registry]() ### AI overview DigitalOcean announces multiple registry support for DigitalOcean Container Registry, allowing teams to create and manage separate registries for distinct environments or distributed teams. The article describes benefits including environment isolation, regional placement, and support for data-residency requirements. ### Source excerpt Introducing Multiple Registry Support on DigitalOcean Container Registry At DigitalOcean, we're dedicated to enhancing our container registry experience, providing users with a simple, powerful tool to organize, manage, and deploy containerized applications. Today, we're excited to announce the General Availability (GA) of a major enhancement to our container registry: the ability to create and manage multiple registries under a single team. Available to customers on the Professional Plan at no additional cost, this feature enables the creation of up to 10 registries per team, delivering great flexibility of image rollout on DigitalOcean. What is Multi-Registry support, and why does it matter? Previously, although one DigitalOcean Container Registry (DOCR) account could create multiple teams, each team was limited to a single container registry. With this update, Professional Plan customers can now create up to 10 registries under a single team, each housing its own independent set of repositories and configurations. This architecture is designed for users managing distinct environments (like development, staging, production) or distributed teams, allowing for compartmentalized registry management. Benefits of Multiple Registries Environment isolation: Segregate different deployment stages (such as dev vs. prod). Regional performance: Provision registries in specific regions (like fra1 or nyc3) to co-locate images with your Kubernetes clusters. This reduces latency and data transfer costs during image pulls. Regulatory compliance: For users with strict data residency requirements (such as GDPR), multiple registries enhance compliance by ensuring container artifacts are stored within a specific geographical jurisdiction. Ready for DOCR's future enhancements: This multi-registry foundation paves the way for DOCR's future advanced capabilities like registry mirroring and geo-replication. How to use the new Multi-Registry feature on DigitalOcean 1. Via the Control Panel ## Detect fallback positions with anchored container queries from Chrome 143 DevFeed: [Detect fallback positions with anchored container queries from Chrome 143]() Original publisher: [Read original article]() Published: 2025-10-29T00:00:00Z Content type: tutorial Language: en Sources: [Una Kravets]() Topics: [container](), [Chrome]() Tags: [chrome](), [container]() ### AI overview A tutorial on identifying and styling an anchored element in a fallback anchor position using anchored container queries from Chrome 143. ### Source excerpt Identify and style an anchored element in a fallback anchor position. ## Blog: Introducing Falco 0.42.0 DevFeed: [Blog: Introducing Falco 0.42.0]() Original publisher: [Read original article]() Published: 2025-10-22T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [container](), [Processes](), [static linking]() Tags: [bug](), [bug-fixes](), [dry-run](), [falco](), [features](), [memory-leak](), [performance](), [recording](), [release](), [static-linking]() ### AI overview Falco 0.42.0 introduces a capture recording feature that generates .scap files when detection rules trigger, including system-call traces for forensic analysis. The release also includes performance improvements, schema validation, configuration changes, and bug fixes. ### Source excerpt Dear Falco Community, today we are happy to announce the release of Falco 0.42.0! This release brings exciting new capabilities, including the capture feature, significant performance improvements, and important bug fixes that enhance Falco's capabilities. During this release cycle, we merged: 52 PRs on Falco, including 23 release note-worthy changes 110 PRs on Falco libs, including 47 release note-worthy changes 102 PRs on Falco drivers, including 29 release note-worthy changes We upgraded libs to version 0.22.1 and drivers to v9.0.0+driver. Thank you to our maintainers and contributors. This would not have been possible without your support and dedication! To learn everything about the changes, read on! What's new? TL;DR Key features: Capture recording feature; Drop enter initiative for performance; Plugin event schema validation; Thread table auto-purging configuration; Static fields; Key fixes: Fix thread table memory leak when parsing vfork (or equivalent clone/clone3 with CLONE_VFORK) exit from the caller process; Enable handling of multiple actions configured with syscall_event_drops.actions; Disable dry-run restarts when Falco runs with config-watching disabled; Fix abseil-cpp for Alpine build; Fix detection sandbox containers for CRI and containerd runtimes (container plugin); Stability improvements for container plugin and static linking of libgcc/libstdc++ for legacy compatibility; This release also comes with breaking changes that you should be aware of before upgrading. Major features and improvements The 0.42.0 release contains a new capture feature and significant performance improvements. Here is a list of the key new capabilities. Capture recording feature Falco 0.42.0 introduces the new capture recording feature, now available at sandbox maturity. This capability allows Falco to generate .scap files whenever a detection rule is triggered automatically. Each capture contains a detailed trace of system calls around the event, providing forensic-level ## Cost Optimisation in ECS: Integrating Spot Instances at Scale DevFeed: [Cost Optimisation in ECS: Integrating Spot Instances at Scale]() Original publisher: [Read original article]() Author: Aakash Singhal Published: 2025-09-12T00:00:00Z Content type: article Language: en Sources: [Deliveroo]() Topics: [Amazon Elastic Container Service](), [Amazon EC2](), [Amazon Web Services](), [Cloud](), [Automation](), [Resilience](), [Availability](), [container]() Tags: [automation](), [availability](), [aws](), [container](), [cost](), [cost-optimisation](), [ec2](), [ecs](), [infrastructure](), [load-balancer](), [resilience](), [scale](), [stateless](), [storage]() ### AI overview Deliveroo describes how it integrated EC2 Spot Instances into Amazon ECS to reduce compute costs while maintaining service stability. The approach routes only eligible workloads to Spot capacity and uses criteria such as fast shutdown, task redundancy, statelessness, and load balancer deregistration timing. ### Source excerpt At Deliveroo, we're always refining how we scale - especially when it comes to managing compute costs in the cloud. After optimising our Amazon ECS workloads with Reserved Instances and Savings Plans, we saw an opportunity to push further using EC2 Spot Instances, which offer up to 90% savings compared to On-Demand prices. But Spot comes with challenges: Their availability can fluctuate, and they can be terminated with just a two-minute warning. To unlock these savings without compromising service stability, we had to engineer a robust solution across infrastructure, workload qualification, and automation. The Challenge: Balancing Cost and Reliability Our ECS infrastructure initially relied entirely on On-Demand EC2 instances, provisioned through Auto Scaling Groups (ASGs) connected to ECS Capacity Providers. While reliable, this approach didn't take advantage of AWS's surplus compute capacity. We aimed to layer Spot Instances into our clusters, but selectively. Our goal was clear: route only eligible workloads to Spot capacity while ensuring no service degradation during unexpected terminations. Spot Instances: Power and Pitfalls Spot Instances provide dramatic cost reductions but introduce several operational caveats: Ephemeral by nature: AWS can terminate them at any time with a two-minute warning. Capacity variability: Availability depends on AWS's excess capacity in each AZ and can shift unpredictably. Scaling limitations: Auto Scaling may fail if the desired instance types are not currently available. To avoid introducing fragility into our stack, we established technical eligibility criteria that workloads must meet before being scheduled on Spot. Defining Spot Eligibility We formalised the following criteria to assess whether a workload could safely tolerate Spot interruptions: Fast Shutdown Support Constraint: stopTimeout must be < 120 seconds in the container definition. Reason: Ensures ECS has time to gracefully shut down the task before AWS's 2-minute te ## Blog: Introducing Falco 0.41.0 DevFeed: [Blog: Introducing Falco 0.41.0]() Original publisher: [Read original article]() Published: 2025-05-29T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [eBPF](), [Kubernetes](), [configuration](), [container](), [JSON](), [Prometheus](), [bug](), [Code Modularity]() Tags: [bug-fixes](), [capabilities](), [changes](), [code-modularity](), [configuration](), [container](), [ebpf](), [falco](), [json](), [kubernetes](), [prometheus](), [release](), [ux]() ### AI overview Falco 0.41.0 introduces revised container engine support, an early Kubernetes operator, configurable merge strategies, expanded eBPF driver behavior, new field access options, and JSON output controls. The release also includes fixes for kernel-module crashes, Prometheus metrics, RPM scripts, and configuration overrides. ### Source excerpt Dear Falco Community, today we are happy to announce the release of Falco 0.41.0! This version brings several new features, performance enhancements, and bug fixes that streamline Falco's detection capabilities. During this release cycle, we merged more than 50 PRs on Falco and around 130 PRs for libs and drivers, version 0.21.0 and version 8.1.0, respectively. Thank you to our maintainers and contributors. This would not have been possible without your support and dedication! To learn everything about the changes, read on! What's new? TL;DR Key features: Reimplemented container engines support from scratch; A Kubernetes operator is taking shape; Falco's config_files configuration gained support to specify the merge strategy; Modern eBPF driver is now capable of trying to load multiple programs for each event; consequently, sendmmsg and recvmmsg will now make use of bpf_loop eBPF helper where available, boosting their performances; New proc.aargs field available, ie: a lookup for an ancestor args field; proc.args gained support for indexed access, to only check a certain argument; json_include_output_fields configuration key for Falco to control whether output fields are included in the JSON message; Ongoing work to improve libs code modularity; Key fixes: Avoid kmod crashing when a CPU gets enabled at runtime; Fixed Falco Prometheus metrics with multiple event sources enabled; Fixed RPM packages evaluation of RPM scripts; -o options do now correctly override included config_files; This release also comes with breaking changes that you should be aware of before upgrading. Major features and improvements The 0.41.0 release contains a number of features and UX improvements. Here is a list of some of the key new capabilities. Reimplemented container engines support In the Falco 0.41.0 release, the Falco team has completely revised its support for container engines. Key improvements include: Container support is now a plugin; The plugin will attach a listener to the eng ## Blog: Detecting Threats in OVHcloud MKS Audit Logs with Falco DevFeed: [Blog: Detecting Threats in OVHcloud MKS Audit Logs with Falco]() Original publisher: [Read original article]() Published: 2025-03-13T00:00:00Z Content type: tutorial Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Kubernetes](), [Security](), [threat detection](), [Kubernetes clusters](), [kubectl](), [Cloud](), [Open Source](), [api server](), [container](), [Amazon EKS](), [Amazon Elastic Kubernetes Service]() Tags: [api](), [audit](), [auditlogs](), [container](), [falco](), [kubectl](), [kubernetes](), [linux](), [logs](), [mks](), [ovhcloud](), [plugin](), [security](), [threat-detection]() ### AI overview This article explains how Falco uses the OVHcloud MKS Audit Logs plugin to detect anomalies, suspicious activity, and policy violations in Kubernetes clusters. It describes Falco's event processing and outlines the required setup involving OVHcloud Logs Data Platform, a data stream, and an MKS cluster. ### Source excerpt Detecting threats in a Kubernetes cluster can be challenging, we generally don't know where and how to start. The good news is that we have an amount of valuable logs that can help us to know what is happened in the cluster. Indeed, each action requested or done by a user or an app, in a cluster, is recorded in Audit Logs. Kubernetes events are key to understanding the behavior of a cluster. We already provide plugins that let you parse Audit Logs and use Falco to detect threats from GKE, EKS and AKS clusters. With our latest plugin, you'll now have the same powerful threat detection capabilities for your OVHcloud MKS clusters 🎉. What is Falco? Falco is an Open Source cloud-native runtime security tool. It provides near real-time threat detection for cloud, container, and Kubernetes workloads by leveraging runtime insights. Falco can monitor events from various sources, including the Linux kernel, and enrich them with metadata from the Kubernetes API server, container runtime, and more. Falco can receive Events, compare them to a set of Rules to determine the actions to perform and generate Alerts to different endpoints. What is the OVH MKS Audit Logs plugin? The OVH audit logs plugin (k8saudit-ovh) extends Falco's capabilities to OVHcloud Managed Kubernetes Service (MKS) clusters, providing you with the same security insights and threat detection Falco already offers for GKE, EKS and AKS environments. With this plugin, you can seamlessly integrate MKS Audit Logs into Falco's event processing pipeline, enabling it to identify anomalies, suspicious activities, and policy violations within your MKS-based workloads. Concretely, when a user executes some kubectl commands in an OVHcloud MKS cluster, Audit Logs will be generated. Falco is listening to them, and depending on the configured rules to follow, it will generate some alerts. Using OVH MKS Audit Logs plugin In order to use the OVH MKS Audit Logs plugin, you must follow several steps: deploy an OVHcloud LDP (Logs ## Get Running with Apache Flink on Kubernetes, part 2 of 2 DevFeed: [Get Running with Apache Flink on Kubernetes, part 2 of 2]() Original publisher: [Read original article]() Published: 2025-01-28T00:00:00Z Content type: tutorial Language: en Sources: [Gunnar Morling]() Topics: [apache-flink](), [Kubernetes](), [Availability](), [observability](), [Deployment](), [container](), [MinIO](), [Amazon S3](), [rocksdb](), [GitHub]() Tags: [apache-flink](), [availability](), [container-images](), [deployment](), [flink](), [github](), [kubernetes](), [minio](), [observability](), [rocksdb](), [s3](), [ui]() ### AI overview Part two of a tutorial series on running Apache Flink jobs on Kubernetes. It explains checkpointing, job manager high availability, savepoints, external object storage, incremental RocksDB checkpoints, observability, and related job-management practices. ### Source excerpt Table of Contents Fault Tolerance and High Availability Manually Triggering Savepoints Observability Bonus: Managing Flink Jobs With the Heimdall UI Summary and Discussion This post originally appeared on the Decodable blog. All rights reserved. Welcome back to this two-part blog post series about running Apache Flink on Kubernetes, using the Flink Kubernetes operator. In part one, we discussed installation and setup of the operator, different deployment types, how to deploy Flink jobs using custom Kubernetes resources, and how to create container images for your own Flink jobs. In this part, we'll focus on aspects such as fault tolerance and high availability of your Flink jobs running on Kubernetes, savepoint management, observability, and more. You can find the complete source code for all the examples shown in this series in the Decodable examples repository on GitHub: on GitHub. ## Deploying Temporal Workers to Google Cloud Run DevFeed: [Deploying Temporal Workers to Google Cloud Run]() Original publisher: [Read original article]() Author: Brandon Chavis Published: 2025-01-06T04:00:00Z Content type: tutorial Language: en Sources: [Temporal Blog]() Topics: [Cloud Run](), [autoscaling](), [Google Cloud Platform (GCP)](), [container](), [Deployment](), [event driven](), [Kubernetes]() Tags: [autoscaling](), [cloud-run](), [container](), [deployment](), [event-driven](), [how-to](), [kubernetes](), [sidecar](), [temporal-concepts]() ### AI overview This tutorial explains how to deploy Temporal Workers on Google Cloud Run using Worker Pools, a sidecar container for metrics, and Cloud Run External Metrics Autoscaling (CREMA) based on Temporal Task Queue backlog. ### Source excerpt Learn how to deploy Temporal Workers on Google Cloud Run with a sidecar container for metrics collection, scaling, and efficient task processing. ## How to use Teleport Machine ID to provide database access to applications running on EKS without passwords DevFeed: [How to use Teleport Machine ID to provide database access to applications running on EKS without passwords]() Original publisher: [Read original article]() Author: info@goteleport.com (Gavin Frazar) Published: 2024-12-03T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Amazon EKS](), [Kubernetes](), [PostgreSQL](), [Authorization](), [AWS Fargate](), [certificates](), [Access Control](), [Amazon Elastic Container Service](), [TLS (Transport Layer Security)](), [AWS IAM](), [container](), [VPC]() Tags: [access-control](), [api-keys](), [aws-fargate](), [aws-iam](), [certificates](), [container](), [ecs](), [how-to](), [kubernetes](), [passwords](), [postgresql](), [secrets](), [tls](), [vpc]() ### AI overview A tutorial on deploying Temporal on Amazon EKS so it can connect to an AWS RDS PostgreSQL database without passwords or other shared secrets. It uses Teleport Machine & Workload Identity, a sidecar, short-lived X.509 certificates, PostgreSQL role provisioning, and a Teleport Database Service deployed on AWS Fargate. ### Source excerpt Discover how to secure database access in Kubernetes workloads. Eliminate secrets, keep databases in private networks, and improve audit logging with Teleport. ## Get Smart in Five Minutes: Container images 101 DevFeed: [Get Smart in Five Minutes: Container images 101]() Original publisher: [Read original article]() Published: 2024-06-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [container images](), [container](), [chainguard image registry](), [Development](), [Security]() Tags: [chainguard-image-registry](), [container](), [container-images](), [development](), [get-smart-in-five-minutes](), [security]() ### AI overview This introductory article presents the first episode of Chainguard's Get Smart in 5 Minutes series, explaining container images, their components, how to choose them, and why they support portable, efficient, secure, and scalable application deployment. ### Source excerpt New to container images? Our quick guide will teach you the fundamentals in no time, covering everything from what they are to how they're used. [Next page]()