Cheatsheet Container

Dasar mental model container sebagai isolasi process, filesystem, network, resource, dan packaging model untuk backend enterprise.

Fondasi Docker engine, Docker CLI, image, container, layer, registry, volume, network, Compose, dan BuildKit.

Praktik Dockerfile untuk Java 17+ JAX-RS service: base image, multi-stage build, dependency layering, non-root runtime, entrypoint, JVM options, dan production review checklist.

JVM behavior dalam container: memory, CPU quota, GC, thread, file descriptor, entropy, timezone, signal handling, SIGTERM, graceful shutdown, dan review checklist production.

Engineering container image untuk reproducibility, security, promotion, vulnerability scanning, SBOM, signing, provenance, dan registry governance dalam konteks enterprise Java/JAX-RS systems.

Docker Compose untuk local development stack PostgreSQL, Kafka, RabbitMQ, Redis, NGINX, Camunda, dan Java/JAX-RS service debugging dengan fokus parity, failure mode, dan production awareness.

Kubernetes sebagai desired state system, control plane, scheduler, runtime orchestrator, networking abstraction, dan platform operasi enterprise untuk Java/JAX-RS services.

Struktur object Kubernetes: apiVersion, kind, metadata, spec, status, label, annotation, selector, owner reference, finalizer, namespace, quota, LimitRange, CRD, controller, operator, dan manifest review checklist.

Lifecycle pod dari image pull, scheduling, init container, container start, readiness, liveness, startup probe, termination, SIGTERM, SIGKILL, restart policy, pod phase, pod condition, dan review checklist untuk Java/JAX-RS services.

Deployment, ReplicaSet, StatefulSet, DaemonSet, Job, CronJob, PodDisruptionBudget, RollingUpdate, Recreate, revision history, rollout, rollback, partitioned rollout, workload selection criteria, anti-patterns, dan review checklist untuk enterprise Java/JAX-RS systems.

Deployment manifest untuk stateless Java/JAX-RS service: container port, HTTP port, management port, resource request, resource limit, environment variable, ConfigMap, Secret, ServiceAccount, probes, graceful shutdown, rolling update, maxUnavailable, maxSurge, readiness before traffic, startup warmup, dan production review checklist.

Liveness probe, readiness probe, startup probe, HTTP probe, TCP probe, exec probe, probe period, timeout, failure threshold, success threshold, probe endpoint design, dependency check anti-pattern, readiness vs liveness mistake, slow startup, probe-induced outage, dan production probe review checklist.

SIGTERM handling, termination grace period, PreStop hook, readiness removal, connection draining, in-flight request, long-running request, Kafka/RabbitMQ consumer shutdown, database transaction shutdown, HTTP client timeout, NGINX/ingress draining, pod deletion lifecycle, rolling update safety, dan graceful shutdown checklist.

ConfigMap, Secret, environment variable, volume mount, projected volume, Downward API, immutable ConfigMap/Secret, config reload, restart-on-config-change pattern, environment-specific config, config precedence, safe default, configuration drift, config validation, dan production config review checklist.

Kubernetes Secret, secret volume, secret environment variable, base64 misconception, encryption at rest, External Secrets Operator awareness, Sealed Secrets awareness, AWS Secrets Manager, Azure Key Vault, SSM Parameter Store, Azure App Configuration, secret rotation, reload, least privilege, leakage risk, dan production secret review checklist.

Pod network, Pod IP, Service IP, ClusterIP, NodePort, LoadBalancer, Endpoint, EndpointSlice, kube-proxy, iptables/IPVS/eBPF awareness, CNI, DNS, CoreDNS, NetworkPolicy, east-west traffic, north-south traffic, dan production networking review checklist.

Service discovery, ClusterIP, NodePort, LoadBalancer, headless service, ExternalName, selector, EndpointSlice, session affinity, port, targetPort, named port, Service without selector, and production troubleshooting for Java/JAX-RS backend systems.

Ingress, IngressClass, Ingress Controller, NGINX Ingress, cloud ingress controller, Gateway API, GatewayClass, Gateway, HTTPRoute, TLS termination, host/path routing, rewrite, backend protocol, sticky session, canary routing, API Gateway vs Ingress, and production review checklist.

Traffic flow dari client, DNS, cloud load balancer, ingress, Kubernetes Service, EndpointSlice, Pod IP, container port, sampai Java/JAX-RS endpoint dalam sistem enterprise.

CoreDNS, Service DNS, Pod DNS, search domain, ndots, headless service, StatefulSet DNS, ExternalName, DNS caching, TTL, private DNS, split-horizon DNS, dan DNS debugging untuk enterprise Kubernetes.

NetworkPolicy ingress/egress, default deny, selector model, DNS/database/messaging/cloud egress, policy debugging, dan microsegmentation untuk enterprise Java/JAX-RS systems.

Fondasi Kubernetes storage: Volume, PV, PVC, StorageClass, access mode, reclaim policy, CSI driver, EmptyDir, ConfigMap/Secret volume, HostPath risk, dan stateful storage review.

StatefulSet, stable identity, stable storage, headless service, PostgreSQL/RabbitMQ/Redis/Kafka/Camunda trade-off, operator pattern, dan managed service vs self-managed stateful workload.

Job, CronJob, completion, parallelism, backoff, active deadline, TTL, concurrency policy, migration job, backfill job, cleanup job, reconciliation job, idempotent design, observability, dan production review.

CPU request, CPU limit, memory request, memory limit, QoS class, OOMKilled, CPU throttling, eviction, node pressure, ephemeral storage, JVM sizing, resource quota, LimitRange, dan production review.

Scheduler, node selector, node affinity, pod affinity, pod anti-affinity, topology spread constraint, taint, toleration, PriorityClass, preemption, zone spreading, dedicated node pool, spot/preemptible awareness, workload isolation, dan production review.

HPA, VPA, Cluster Autoscaler, Karpenter awareness, Metrics Server, CPU-based scaling, memory-based scaling, custom metrics, external metrics, queue-based scaling, KEDA awareness, scale-to-zero, scaling latency, thrashing, Kafka/RabbitMQ consumer scaling, dan production review.

Pod Security Standards, SecurityContext, run as non-root, read-only root filesystem, capabilities, privileged container, host network, host PID, HostPath, seccomp, AppArmor, SELinux awareness, admission control, image policy, runtime security, dan pod security review.

ServiceAccount, Role, ClusterRole, RoleBinding, ClusterRoleBinding, least privilege, namespace-scoped permission, token projection, automount token, workload identity, CI/CD permission, GitOps permission, RBAC debugging, dan RBAC review checklist.

Kubernetes ServiceAccount identity, AWS IAM Roles for Service Accounts, OIDC provider, STS AssumeRoleWithWebIdentity, AWS SDK credential resolution, Azure Workload Identity, Managed Identity, federated credential, Azure SDK credential resolution, pod identity legacy awareness, token audience, cloud permission boundary, identity troubleshooting, dan cloud identity review checklist.

AWS SDK dan Azure SDK dari Kubernetes pod: credential provider chain, IAM/RBAC permission, VPC/private endpoint, DNS resolution, TLS, proxy, egress policy, retry, timeout, rate limit, secretless access, cloud call observability, failure modes, debugging, dan cloud service call review checklist.

AWS VPC Endpoint, AWS PrivateLink, Azure Private Endpoint, Private DNS Zone, route table, security group, NSG, firewall, split-horizon DNS, service endpoint awareness, pod-to-private-endpoint flow, on-prem-to-cloud private connectivity, hybrid DNS, troubleshooting, dan private endpoint review checklist.

Image vulnerability scanning, dependency scanning, SBOM, SCA, CVE triage, base image patching, image signing, admission policy, registry access control, provenance, build secret leakage, Docker socket risk, CI runner security, artifact promotion, dan supply-chain security checklist.