PT Segoro Mulyo Solusindo

Tag: Cloud Native

Cloud-native architecture patterns, microservices, containers, and serverless computing security.

  • API for MoQ: Provision Isolated Relays for Streaming

    Provisioning an API for MoQ transforms how engineers handle real-time media streaming infrastructure today. Low latency streaming demands innovative protocols like Media over QUIC. Yet, managing isolated relays at scale remains a massive challenge for teams globally. Recent architectural breakthroughs change this landscape entirely. Developers can now automate relay provisioning programmatically with ease.

    Real-time communication relies heavily on robust transport layers. Traditional RTMP and WebRTC stacks often introduce scaling bottlenecks or heavy stateful overhead. Enter Media over QUIC (MoQ), a modern protocol standardizing media transport over QUIC connections. This protocol provides multiplexing, congestion control, and rapid connection migration out of the box.

    However, running a global network of relays requires dynamic orchestration. Network engineers need a reliable way to spin up localized nodes on demand. That is why building an automated control plane matters so much for modern workflows. Let us explore how modern edge computing solves this dilemma.

    Understanding the Architecture of MoQ Relays

    Media over QUIC operates on a publish-subscribe model. Publishers send media tracks to nearby edge nodes. Subscribers connect to the same edge nodes to receive streams instantly. Relays intermediate this traffic across wide area networks.

    Isolated relays prevent noisy neighbor problems in multi-tenant environments. Each broadcast gets its own dedicated relay instance or namespace container. This isolation guarantees predictable bandwidth and low jitter. Furthermore, security improves because tenant data never crosses memory boundaries improperly.

    Cloudflare pioneered extensive research into this domain. You can read the original insights directly via the Cloudflare MoQ Relays blog post for deep technical context. Their findings highlight the viability of running ephemeral relays at the edge.

    Core Components of an API for MoQ

    An effective control plane exposes clear endpoints for lifecycle management. First, authentication tokens verify client requests securely. Second, allocation engines determine the optimal geographic location for the relay instance.

    Once allocated, the orchestrator provisions containerized workloads near the user base. QUIC listeners bind to dynamic ports immediately. These components communicate via lightweight internal messaging systems to synchronize global routing tables.

    Developers interact with these systems using standard HTTP verbs. A simple POST request can spin up a dedicated relay in seconds. Conversely, DELETE requests tear down resources to optimize cloud spending efficiently.

    Implementing Automated Provisioning Workflows

    Automation eliminates human error in infrastructure deployment. Infrastructure-as-Code tools integrate seamlessly with modern control APIs. Consequently, scaling up during peak traffic events happens automatically without manual intervention.

    Security must remain a top priority during orchestration. Zero Trust principles dictate that every relay instance verifies incoming connection parameters strictly. Mutual TLS secures communication channels between control planes and worker nodes.

    To dive deeper into securing modern edge workloads, explore our cyber security archive for practical hardening guides.

    Practical Code Example for Relay Creation

    Below is a conceptual Python snippet demonstrating an API request to provision a relay:

    import requests

def provision_moq_relay(region, tenant_id):
    url = 'https://api.edge.net/v1/relays'
    payload = {
        'region': region,
        'tenant': tenant_id,
        'protocol': 'QUIC'
    }
    headers = {'Authorization': 'Bearer secret_token_123'}
    response = requests.post(url, json=payload, headers=headers)
    return response.json()

    This function targets the control service. It submits geographic preferences and tenant identifiers securely. The service returns connection endpoints for publishers and subscribers.

    Overcoming Edge Networking Obstacles

    Deploying QUIC-based services introduces unique firewall challenges. Stateful packet inspection devices sometimes misclassify QUIC traffic as UDP floods. Network administrators must configure edge routers to permit UDP port 443 transparently.

    Another hurdle involves IP routing asymmetry. BGP anycast routing helps direct clients to the nearest data center. However, sudden route flaps can disrupt active QUIC connections. Robust connection migration features mitigate these drops gracefully.

    Monitoring relay health requires specialized telemetry pipelines. Prometheus metrics scrape CPU usage, packet loss, and active stream counts continuously. Operators visualize this data on real-time dashboards to spot anomalies early.

    Scaling Strategies for Global Audiences

    Global distribution demands decentralized relay clusters. Regional controllers manage local nodes independently. If one region experiences an outage, global DNS shifts traffic to healthy neighboring zones.

    Cost optimization drives the need for ephemeral infrastructure. Relays exist only as long as the live stream broadcasts. Once the broadcast ends, automation destroys the containers immediately.

    Adopting these patterns elevates your streaming architecture significantly. Teams achieve massive scalability while maintaining strict isolation and low operational overhead.

    Conclusion

    Leveraging an API for MoQ empowers organizations to build scalable, secure, and ultra-low-latency video streaming platforms. Automating isolated relays ensures predictable performance and robust multi-tenant security. Begin testing these protocols today to future-proof your real-time infrastructure.

  • Cloudflare Internal DNS is Now Generally Available

    Cloudflare Internal DNS is now generally available for all enterprise organizations worldwide. Modern IT infrastructure teams often struggle with private name resolution across hybrid networks. Traditional bind servers create operational overhead and security vulnerabilities.

    Zero Trust architecture requires secure verification of every request. Cloudflare addresses this challenge directly with robust private DNS capabilities. Network administrators can now manage private zones efficiently.

    Understanding Cloudflare Internal DNS Architecture

    Cloudflare Internal DNS Core Features

    Enterprise networks rely heavily on secure name resolution. Cloudflare Internal DNS integrates seamlessly into your existing edge topology. Administrators configure private zones instantly through the intuitive dashboard.

    Global edge caching ensures lightning-fast query resolution. Security teams protect internal assets without deploying complex infrastructure. Furthermore, you can read the official announcement on Cloudflare Internal DNS for deeper technical insights.

    Security and Access Control

    Granular access policies dictate who queries specific internal records. Cloudflare Gateway enforces these rules at the network layer. Consequently, unauthorized actors cannot discover internal service topologies.

    Encryption protects all DNS traffic in transit. Modern protocols like DNS over HTTPS secure sensitive queries effectively. Organizations maintain compliance with strict industry frameworks easily.

    Implementing Cloudflare Internal DNS in Production

    Step-by-Step Configuration

    Deployment begins inside the Zero Trust dashboard. Engineers define private zones corresponding to internal domain names. Next, routing rules direct specific queries to designated upstream resolvers.

    Warp clients handle endpoint traffic redirection automatically. Laptops connect securely from remote locations without manual VPN toggling. Productivity increases while attack surfaces shrink dramatically.

    Monitoring and Troubleshooting

    Real-time analytics provide deep visibility into query patterns. Security analysts detect anomalous behavior before breaches occur. Comprehensive logs export directly to SIEM platforms for auditing.

    Robust monitoring ensures high availability across global regions. Automated failover prevents catastrophic outages during network partitions. Reliability remains exceptionally high for mission-critical applications.

    Conclusion

    Cloudflare Internal DNS revolutionizes private network management today. Organizations achieve unprecedented security and operational agility immediately. Deploy this solution to modernize your enterprise architecture now.

  • Red Hat build of Karpenter: Modern Kubernetes Autoscaling

    Red Hat build of Karpenter transforms modern Kubernetes autoscaling on enterprise infrastructure. Traditional cluster autoscalers frequently lag during demand spikes. This delay impacts application performance and inflates operational budgets significantly.

    Organizations require rapid node provisioning to handle dynamic workloads. Kubernetes engineers constantly struggle with slow scale-up times and rigid node group limitations. Red Hat solves these bottlenecks by introducing an enterprise-ready autoscaling solution.

    Understanding Karpenter Architecture in Enterprise Environments

    Karpenter was originally born as an open-source project to solve cloud-native scaling challenges. It bypasses traditional cluster autoscaler mechanisms by communicating directly with cloud providers. This direct integration eliminates intermediate layers that typically cause latency.

    Red Hat brings its enterprise hardening expertise to this upstream project. The Red Hat build of Karpenter integrates seamlessly with OpenShift environments. Administrators gain predictable performance backed by robust enterprise support and security patches.

    Core Benefits of Red Hat build of Karpenter

    Scale speed remains the primary advantage of this modern autoscaler. Pods launch in seconds rather than minutes during high-traffic events. Furthermore, bin-packing efficiency ensures optimal resource utilization across every deployed node.

    Cost reduction naturally follows efficient resource management and consolidation. Teams avoid over-provisioning infrastructure because nodes terminate immediately when idle. Read more about these optimizations through the official Red Hat build of Karpenter announcement.

    Security hardening represents another vital pillar for enterprise deployments. Red Hat configures every component to meet strict compliance frameworks. Administrators maintain total visibility over their cluster infrastructure without compromising speed.

    Implementing Advanced Autoscaling on OpenShift

    Deploying the new autoscaler requires careful planning and proper configuration. Platform engineers must define provisioners that dictate node constraints and behaviors. These custom resources guide how the system handles incoming pod scheduling requests.

    Compatibility with existing Cloud Computing infrastructure ensures smooth adoption. Organizations do not need to rewrite their existing deployment manifests. Instead, they simply update their cluster scaling parameters to leverage the new engine.

    Best Practices for Production Clusters

    Start by testing provisioner configurations in non-production environments first. Monitor scaling metrics closely to understand node lifecycle behaviors under load. Additionally, establish proper resource requests on all workloads to guide scheduling decisions accurately.

    Review security policies regularly to maintain cluster integrity during rapid scaling. Combine these automated workflows with insights from Cybersecurity frameworks to protect dynamic nodes. Continuous monitoring guarantees resilient operations across all distributed applications.

    Conclusion

    Red Hat build of Karpenter redefines how organizations handle dynamic Kubernetes workloads. Fast provisioning and intelligent bin-packing reduce infrastructure costs while improving application reliability. Upgrade your scaling strategy today to harness the full potential of cloud-native automation.

  • Two-node OpenShift with fencing improves reliability at the edge

    Deploying critical applications at the edge presents unique challenges. Two-node OpenShift with fencing improves reliability by ensuring consistent operations during outages. Organizations often struggle with maintaining uptime in remote locations. This solution addresses those limitations effectively. Consequently, IT teams gain better control over their infrastructure health.

    Understanding Two-node OpenShift with Fencing

    Standard clusters typically require at least three nodes for quorum. However, edge locations frequently lack space or power for such hardware. Therefore, Red Hat introduced a compact two-node architecture. This configuration runs masters and workers together efficiently.

    Despite its efficiency, losing one node often risks system instability. The cluster might hang if the remaining node cannot confirm the status of the other. Thus, implementing fencing mechanisms becomes essential. Fencing isolates the unresponsive node to prevent data corruption.

    Why Fencing Improves Reliability at the Edge

    Fencing acts as a fail-safe in distributed systems. It guarantees that only one node acts as the primary controller. Without this, split-brain scenarios could destroy database integrity. Hence, reliable fencing ensures your Cloud & Virtualization environment stays functional.

    Moreover, the integration within OpenShift simplifies complex edge management. Administrators no longer need manual intervention during minor network hiccups. Automated recovery saves time and reduces operational costs significantly. Such robust design defines modern IT Security practices.

    Architectural Benefits for Edge Deployments

    Modern businesses require Cloud Native consistency everywhere. Two-node OpenShift with fencing provides exactly that flexibility. It brings core data center capabilities to remote, resource-constrained sites.

    Furthermore, this architecture reduces hardware footprint requirements. You minimize maintenance efforts while maximizing available compute resources. Consequently, your edge operations remain agile and highly available.

    Optimizing System Uptime Through Automation

    Automation remains at the heart of this deployment strategy. The system automatically detects node failures and triggers fencing protocols. This proactive approach prevents downtime before users notice any issues. Indeed, this capability elevates your overall Network Resilience.

    Additionally, consistent patching becomes much easier with this setup. You can rotate updates across your nodes without disrupting critical services. For more details on this approach, review the original Red Hat technical guidance.

    Implementation Best Practices

    Successful deployment requires careful planning and hardware validation. Always ensure your power management controllers support fencing APIs. Testing these scenarios in a lab environment remains mandatory. Never skip failover drills during your initial integration phase.

    Furthermore, monitor your latency between edge nodes continuously. High latency can trigger false positive fencing events. Therefore, stable interconnects are vital for overall stability. Finally, maintain detailed logs for auditing and troubleshooting purposes.

    Conclusion

    In summary, two-node OpenShift with fencing improves reliability by providing automated failover capabilities. This approach is essential for modernizing edge infrastructure effectively. We recommend evaluating your current remote architecture against these standards today. Start implementing these robust configurations to ensure your distributed services remain resilient against unexpected site outages.

  • Kubernetes fleet management: Key Survey Results Explained

    Kubernetes fleet management: Key Survey Results Explained

    As organizations scale their cloud-native footprints, Kubernetes fleet management has emerged as the critical differentiator between operational success and infrastructure chaos. Recent research from Red Hat highlights how platform engineering teams are navigating the complexity of managing large-scale, multi-cluster environments. This article explores these essential findings for IT leaders and practitioners.

    Understanding Kubernetes fleet management challenges

    Modern enterprises no longer run isolated clusters. Instead, they operate distributed environments across hybrid clouds. This scale demands a shift in how teams approach cluster lifecycle management. According to the Red Hat survey, consistency remains the primary hurdle for infrastructure teams.

    Scaling requires automated policy enforcement across every cluster. When teams manage clusters manually, security gaps inevitably widen. Centralized control planes are no longer optional luxuries. They are fundamental components of a resilient architecture. Many organizations struggle with the operational overhead of maintaining disparate versions of the container runtime.

    Operationalizing Kubernetes fleet management strategies

    Success starts with standardizing cluster deployment patterns. Platform teams must treat infrastructure as code to reduce configuration drift. By implementing GitOps workflows, teams can ensure that their desired state matches the actual state of their clusters. This approach significantly lowers the risk of human error during updates.

    Furthermore, observability plays a vital role in fleet-wide health. Teams need centralized dashboards to monitor metrics across geographic regions. Without this visibility, troubleshooting cross-cluster connectivity issues becomes a tedious, time-consuming task. Effective Kubernetes fleet management requires granular audit logs to ensure compliance and security.

    Consistent governance is another critical pillar for managing containerized workloads. By defining guardrails centrally, administrators can delegate cluster access safely. This method empowers developers while maintaining strict organizational security standards. Read more about improving infrastructure resilience here.

    Addressing security and compliance at scale

    Security is the most significant concern for large-scale Kubernetes deployments. Managing secrets across multiple clusters presents a constant operational challenge. Without unified identity and access management, organizations invite unnecessary risks. Vulnerability management also necessitates a systematic approach to patching container images.

    Many security teams struggle to achieve visibility into their software supply chain. As noted in recent Red Hat research, automated security policies reduce the attack surface significantly. Implementing a zero-trust model remains the gold standard for multi-cluster environments.

    Automation in Kubernetes fleet management

    Automation serves as the backbone of modern container infrastructure. It removes the friction from routine maintenance tasks like certificate rotation. When tasks are automated, developers focus more on building features rather than infrastructure upkeep. This shift accelerates time-to-market for critical business applications.

    Additionally, CI/CD pipelines must integrate security scanning at every stage. This shift-left strategy prevents vulnerabilities from reaching production environments. Standardizing the container stack also simplifies the auditing process for regulatory compliance. Effective Kubernetes fleet management relies heavily on consistent policy enforcement and automation.

    Ultimately, the survey confirms that platform engineering is the key to managing complexity. By investing in the right tooling and processes, teams can harness the full power of Kubernetes. Organizations must prioritize scalable, automated workflows to stay competitive in a cloud-native world. Standardizing on a robust platform ensures long-term operational excellence and stability.

    Conclusion

    The latest Kubernetes fleet management survey confirms that scale brings significant operational complexity. To succeed, organizations must adopt automated, policy-driven architectures. Platform engineering teams should prioritize centralized control and robust security guardrails. Start by auditing your current cluster management processes and transition toward a GitOps-based model to ensure consistent, secure, and scalable performance across your enterprise.

  • Red Hat OpenShift 4.22 Observability Features Explained

    Related Reading

    For more context, see also: AI security.

    Red Hat OpenShift 4.22 Observability Features for Modern IT

    The latest release of Red Hat OpenShift 4.22 introduces critical observability features that empower infrastructure teams to maintain high-availability systems. As organizations scale their cloud-native deployments, having deep visibility into cluster health and application performance becomes non-negotiable. These updates streamline monitoring, logging, and tracing to reduce incident response times significantly. By leveraging these native tools, practitioners can proactively identify bottlenecks before they impact end-user experience.

    Enhancing Cluster Insights with Red Hat OpenShift 4.22 Observability Features

    Operational complexity continues to challenge IT teams managing distributed systems. Therefore, the new Red Hat OpenShift 4.22 observability features provide granular control over telemetry data. You can now aggregate metrics more efficiently across large-scale environments. Furthermore, improved dashboarding capabilities allow teams to visualize key performance indicators with greater precision. Such advancements directly support better capacity planning and resource allocation strategies within your Red Hat infrastructure.

    Administrators often struggle with excessive alert noise in complex environments. Fortunately, the updated observability stack includes refined alerting rules and better integration with external monitoring systems. These tools enable engineers to focus on actionable intelligence rather than managing fragmented log data. Additionally, security teams can use these logs to track unauthorized access attempts or unusual traffic patterns, strengthening the overall security posture. Effective DevSecOps practices rely heavily on this transparency.

    Technical Deep Dive: How the Updates Work

    At the core of these enhancements, Red Hat has optimized the Prometheus and Grafana stack within the OpenShift platform. The latest version improves query performance, ensuring that real-time monitoring does not overwhelm the control plane. Specifically, the updated observability stack reduces latency during peak load scenarios. Moreover, the integration of OpenTelemetry standards ensures compatibility with a wider ecosystem of third-party tools. This interoperability simplifies the migration of existing workloads while maintaining consistent monitoring standards.

    Another notable improvement involves the long-term storage of metric data. In previous iterations, data retention often presented a significant cost and performance trade-off. However, OpenShift 4.22 addresses this by optimizing backend storage interfaces. Consequently, teams can retain historical data for compliance auditing without sacrificing query speed. This is crucial for forensic analysis after a security event occurs. Furthermore, the ability to correlate application logs with infrastructure metrics provides a comprehensive view of the service mesh. Such deep visibility simplifies troubleshooting across hybrid cloud environments.

    Strategic Benefits for Enterprise Deployment

    Implementing these new observability features yields measurable benefits for enterprise IT. First, it reduces the mean time to repair (MTTR) by providing context-aware alerts. Instead of receiving generic error messages, teams gain direct insight into failing components. Second, these features enhance capacity planning by revealing resource usage trends over extended periods. Consequently, businesses can optimize their cloud spending by right-sizing clusters based on actual data rather than estimations. Finally, this release underscores Red Hat’s commitment to building a robust, developer-friendly platform that prioritizes reliability and security.

    To get started, teams should audit their current logging and monitoring architecture. Review existing custom rules to ensure compatibility with the updated metrics collection methods. We recommend performing a staged rollout in a development cluster before upgrading production environments. Leverage the official documentation to understand the new API endpoints introduced in this release. By doing so, your organization will fully realize the efficiency gains offered by these powerful new tools.

    Conclusion and Recommended Actions

    In summary, the Red Hat OpenShift 4.22 observability features represent a major milestone for infrastructure monitoring. By adopting these tools, you improve your ability to detect, diagnose, and remediate issues in production. We recommend upgrading your clusters to 4.22, implementing consistent log aggregation, and refining your alerting thresholds to maximize the platform’s potential for your business.

  • Docker vs Virtual Machines: Performance, Deployment, and Use Cases

    Docker vs Virtual Machines: Performance, Deployment, and Use Cases

    Choosing between Docker containers and virtual machines (VMs) is a foundational decision for modern application architecture. Both technologies let you run multiple workloads on shared infrastructure, but they do so in fundamentally different ways-each with distinct performance profiles, operational overhead, and security implications. This guide breaks down the practical differences to help you pick the right approach for your use case.

    How Virtual Machines Work

    A virtual machine is a complete operating system instance virtualized on top of a hypervisor. Each VM runs its own full OS kernel, system services, and applications, completely isolated from other VMs on the same physical host. The hypervisor-whether a bare-metal type like VMware ESXi or a hosted type like VirtualBox-abstracts physical hardware and allocates CPU, memory, storage, and network resources to each VM independently.

    Key characteristics of VMs:

    • Full OS per instance: Windows, Linux, or BSD with its own kernel.
    • Strong isolation at the hardware level.
    • Typical startup time: 30 seconds to several minutes.
    • Resource overhead: each VM needs dedicated RAM and storage for the OS itself.
    • Supported by all major cloud providers (AWS EC2, Azure VMs, Google Compute Engine).

    VMs are the proven choice for running legacy applications, Windows workloads, or any scenario requiring strict hardware-level isolation. The VMware vSphere documentation provides deep technical details on VM resource management and scheduling.

    How Docker Containers Work

    Docker containers share the host OS kernel but isolate applications in user space. Each container includes only the application binary, its dependencies, and a thin read-write layer. Because they bypass the hypervisor layer entirely, containers start in milliseconds, consume far less memory, and achieve near-native CPU performance. This makes them ideal for microservices, CI/CD pipelines, and cloud-native applications.

    Key characteristics of containers:

    • Shared kernel: containers on the same host run the same OS kernel.
    • Lightweight isolation using Linux namespaces and cgroups.
    • Typical startup time: milliseconds to a few seconds.
    • Minimal resource overhead: no separate OS to maintain.
    • First-class support on Kubernetes, Docker Swarm, and cloud container services (ECS, AKS, GKE).

    The Docker documentation covers the architecture in detail, including image layers, the container runtime, and how container networking differs from VM networking.

    Performance Comparison

    When evaluating performance, several dimensions matter:

    CPU and Memory

    Containers have a clear edge in CPU and memory efficiency. Because they share the host kernel and don’t run a full OS, containers consume 10–30% less memory and incur near-zero virtualization overhead for CPU operations. A containerized nginx server typically uses 10–20 MB of RAM versus 100+ MB for a VM running the same service.

    VMs are preferred when applications require dedicated CPU cores, real-time scheduling guarantees, or when Windows licensing is a factor-each Windows VM requires its own license, while Windows containers can share a host license in specific scenarios.

    Startup Time and Density

    Containers start in milliseconds, enabling auto-scaling, on-demand provisioning, and rapid CI/CD pipelines. VMs take 30–120 seconds to boot, which makes them unsuitable for bursty workloads but fine for stable, long-running services. The density advantage of containers is significant: a single host can typically run 5–10x more containers than equivalent VMs.

    Storage

    Container images use layered storage (copy-on-write) that is very efficient for stateless workloads. A base image of 200 MB can be shared across hundreds of containers, using only the delta for each unique layer. VM disks are full virtual drives (often 40–100 GB each) that cannot be efficiently shared in the same way.

    Networking

    Containers typically use software-defined networking with overlay tunnels (VXLAN, Calico) that add minimal overhead. VMs use traditional virtual switches that provide slightly more isolation at the cost of more complexity in large-scale environments. For a side-by-side comparison, see VMs vs Docker Containers: Architectural and Strategic Guide.

    Security Considerations

    Security is where the choice gets nuanced. VMs provide stronger isolation boundaries because each has a separate kernel. A kernel exploit inside one VM cannot directly compromise another VM. Containers share the kernel, so a container escape vulnerability (like CVE-2022-0185 or runc vulnerabilities) can potentially affect the entire host.

    Container Security Best Practices

    • Use minimal base images (Alpine, distroless) to reduce attack surface.
    • Scan images for vulnerabilities with tools like Trivy, Grype, or Snyk before deployment.
    • Run containers as non-root and use read-only filesystems where possible.
    • Enforce pod security standards (PSS) or Open Policy Agent (OPA) in Kubernetes.
    • Network policies: restrict traffic between containers using Kubernetes NetworkPolicy or Calico rules.
    • Read-only root filesystems and dropped capabilities limit container privilege escalation risk.

    VM Security Best Practices

    • Keep hypervisors and VM tools updated against VM-escape vulnerabilities.
    • Use VM encryption (vSphere VM Encryption, Hyper-V Shielded VMs) for sensitive workloads.
    • Implement microsegmentation to limit east-west traffic between VMs.
    • Enable secure boot, vTPM, and live migration encryption where supported.
    • Harden guest OSes using CIS Benchmarks for your OS type.

    Use Case Guide: When to Choose What

    Choose Docker Containers When:

    • You are building microservices or cloud-native applications.
    • You need rapid scaling, auto-scaling, or bursty workloads.
    • Your team uses Kubernetes or a container orchestration platform.
    • You want fast builds, CI/CD pipelines, and reproducible environments.
    • You are deploying on Linux and your applications are Linux-compatible.

    Choose Virtual Machines When:

    • You need to run Windows workloads or applications with specific kernel requirements.
    • Strong hardware-level isolation is required (e.g. compliance mandates).
    • You are running legacy applications that cannot be containerized.
    • You need dedicated, guaranteed resources without shared-kernel overhead.
    • Your operations team has deep VM administration expertise.

    Use Both Together (The Common Pattern)

    Modern production environments frequently use both: VMs as the foundation (bare metal hosts running a hypervisor or a managed VM layer), with containers running on top (via Docker, Kubernetes on VMs). This gives you the isolation and familiarity of VMs plus the density and speed of containers. Cloud providers like Amazon EKS and Azure AKS run Kubernetes control planes on VMs, with your workloads in containers.

    For a deeper comparison of container and VM architectures, see VMs vs Docker Containers: Architectural and Strategic Guide.

    Related Reading

    For deeper context on docker vs virtual machines, see also: container vs VM and Docker Desktop CVE.

    Conclusion

    Docker containers and virtual machines each have a place in modern infrastructure. Containers excel at density, speed, and developer experience; VMs excel at isolation, compatibility, and operational simplicity. The best architectures use both strategically: stable VM foundations with container workloads on top, or containers for stateless microservices and VMs for stateful, compliance-sensitive workloads. Assess your application requirements, team expertise, and security posture to make the right call for your specific environment.