Containers & IaC
37. Containers, Orchestration & IaC: Podman, Docker, OCI, ECS & Terraform
Compare rootless daemonless Podman with Docker, evaluate Container as a Service (ECS/Render) vs FaaS, and declare infrastructure with Terraform.
containers-iac.ts
// Infrastructure as Code (IaC) & Container Definition
// main.tf (OpenTofu / Terraform AWS ECS Fargate & Cloudflare)
/*
resource "aws_ecs_task_definition" "web_engine" {
family = "web-engine-production"
requires_compatibilities = ["FARGATE"]
network_mode = "awsvpc"
cpu = 256
memory = 512
execution_role_arn = aws_iam_role.ecs_execution_role.arn
container_definitions = jsonencode([{
name = "sveltekit-app"
image = "ghcr.io/org/web-engine:latest"
essential = true
portMappings = [{ containerPort = 3000, hostPort = 3000 }]
environment = [
{ name = "NODE_ENV", value = "production" },
{ name = "ORIGIN", value = "https://engine.example.co.uk" }
]
}])
}
*/Containers, Orchestration & IaC: Podman, Docker, OCI, ECS & Terraform
Modern cloud applications bridge development and production through OCI container standards and declarative Infrastructure as Code (IaC).
- Rootless Podman vs Docker: Podman runs containers directly under user namespaces without a centralised background root daemon, preventing root privilege escalation.
- Container as a Service (CaaS): AWS ECS Fargate and Render allow hosting stateful Node servers, WebSockets, and background workers without managing underlying virtual machines.
- Declarative IaC: OpenTofu, Terraform, and Pulumi treat cloud topology as version-controlled source code, enabling reproducible deployments across multi-region environments.
- Open Container Initiative (OCI): Adheres to strict
image-specandruntime-specdefinitions supported across all container engines.
Container Runtime & CaaS Evaluator OCI Specifications
Podman (Pod Manager)
Daemonless fork/exec process model
Security Model:
Rootless by default; isolated user namespaces (subuid/subgid)
Daemon Architecture:
No background root daemon (0 socket attack surface)
Orchestration & Tooling:
Direct Kubernetes YAML pods & podman-compose
Recommended For:
High-security enterprise Linux environments, local dev, Fedora/RHEL
Declarative Infrastructure as Code (IaC) IaC Blueprints
OpenTofu / Terraform (HCL) Declarative Topology
resource "aws_ecs_task_definition" "web_engine" {
family = "web-engine-prod"
requires_compatibilities = ["FARGATE"]
network_mode = "awsvpc"
cpu = 256
memory = 512
execution_role_arn = aws_iam_role.ecs_role.arn
container_definitions = jsonencode([{
name = "sveltekit-node"
image = "ghcr.io/acme-org/web-engine:latest"
essential = true
portMappings = [{ containerPort = 3000, hostPort = 3000 }]
environment = [
{ name = "NODE_ENV", value = "production" },
{ name = "ORIGIN", value = "https://engine.acme.co.uk" }
]
}])
}