Pause Containers

In the namespaces note, we saw that Kubernetes pods have only certain namespaces. When kubelet gets a request for a pod, it creates one dummy container. This container holds the isolated namespaces.

Then the CNI links this isolated network namespace to the host. All containers in this logical group use that link.

docker run with arguments

Docker lets you start a container that joins another container's namespaces.

docker run --name k8s_app_my-pod \
  --network container:k8s_POD_my-pod \  # Join pause's network NS
  --ipc container:k8s_POD_my-pod \      # Join pause's IPC NS
  --pid container:k8s_POD_my-pod \      # If shareProcessNamespace
  --volume /var/lib/kubelet/pods/.../mount:/data \ # Bind mount volume from pause's mount namespace
  my-app-image

Why we need this?

1. Say the main containers own the shared namespaces. Then if one container fails, the others break too.
2. We would have to keep a strict startup order.
3. Any container restart would destroy the namespaces.