Containers & IaC

37. Containers, Orchestration & IaC: Podman, Docker, OCI, ECS & Terraform

Compare rootless daemonless Podman with Docker, evaluate Container as a Service (ECS/Render) vs FaaS, and declare infrastructure with Terraform.

containers-iac.ts
// Infrastructure as Code (IaC) & Container Definition
// main.tf (OpenTofu / Terraform AWS ECS Fargate & Cloudflare)
/*
resource "aws_ecs_task_definition" "web_engine" {
  family                   = "web-engine-production"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = 256
  memory                   = 512
  execution_role_arn       = aws_iam_role.ecs_execution_role.arn

  container_definitions = jsonencode([{
    name      = "sveltekit-app"
    image     = "ghcr.io/org/web-engine:latest"
    essential = true
    portMappings = [{ containerPort = 3000, hostPort = 3000 }]
    environment = [
      { name = "NODE_ENV", value = "production" },
      { name = "ORIGIN", value = "https://engine.example.co.uk" }
    ]
  }])
}
*/

Containers, Orchestration & IaC: Podman, Docker, OCI, ECS & Terraform

Modern cloud applications bridge development and production through OCI container standards and declarative Infrastructure as Code (IaC).

  • Rootless Podman vs Docker: Podman runs containers directly under user namespaces without a centralised background root daemon, preventing root privilege escalation.
  • Container as a Service (CaaS): AWS ECS Fargate and Render allow hosting stateful Node servers, WebSockets, and background workers without managing underlying virtual machines.
  • Declarative IaC: OpenTofu, Terraform, and Pulumi treat cloud topology as version-controlled source code, enabling reproducible deployments across multi-region environments.
  • Open Container Initiative (OCI): Adheres to strict image-spec and runtime-spec definitions supported across all container engines.
Container Runtime & CaaS Evaluator OCI Specifications

Podman (Pod Manager)

Daemonless fork/exec process model

Security Model:

Rootless by default; isolated user namespaces (subuid/subgid)

Daemon Architecture:

No background root daemon (0 socket attack surface)

Orchestration & Tooling:

Direct Kubernetes YAML pods & podman-compose

Recommended For:

High-security enterprise Linux environments, local dev, Fedora/RHEL

Declarative Infrastructure as Code (IaC) IaC Blueprints
OpenTofu / Terraform (HCL) Declarative Topology
resource "aws_ecs_task_definition" "web_engine" {
  family                   = "web-engine-prod"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = 256
  memory                   = 512
  execution_role_arn       = aws_iam_role.ecs_role.arn

  container_definitions = jsonencode([{
    name      = "sveltekit-node"
    image     = "ghcr.io/acme-org/web-engine:latest"
    essential = true
    portMappings = [{ containerPort = 3000, hostPort = 3000 }]
    environment = [
      { name = "NODE_ENV", value = "production" },
      { name = "ORIGIN", value = "https://engine.acme.co.uk" }
    ]
  }])
}