Orchestration

Orchestration#

Orchestration is how the operator runs containers at fleet scale. A container orchestrator schedules workloads across many machines, restarts them when they fail, routes traffic to them, and reconciles the running state with a declared desired state. Kubernetes is the de-facto standard; everything else converges on its object model or deliberately stays simpler.

For the operator the orchestrator is a force multiplier and an attack surface in equal measure. It deploys defended workloads without manual touch, but every API server, every misconfigured RBAC rule, and every escaped container is the next intruder’s pivot. Knowing the object model and the cluster’s component layout is the price of entry to either side.

        flowchart LR
  User[User / Client] --> Ing[Ingress]
  Ing --> Svc[Service<br/>ClusterIP]
  Svc --> P1[Pod]
  Svc --> P2[Pod]
  Svc --> P3[Pod]

  subgraph Workload["Deployment"]
    direction TB
    RS[ReplicaSet] --> P1
    RS --> P2
    RS --> P3
  end

  CM[ConfigMap] -.-> P1
  Sec[Secret] -.-> P1
  PVC[(PersistentVolumeClaim)] -.-> P1

  subgraph CtrlPlane["Control Plane"]
    direction TB
    API[kube-apiserver]
    Sched[kube-scheduler]
    CM2[kube-controller-manager]
    ETCD[(etcd)]
    API --- ETCD
    API --- Sched
    API --- CM2
  end

  CtrlPlane --> Workload

The Landscape#

The orchestrators the operator runs into in the wild:

Orchestrator	Niche
Kubernetes	The standard. Greenfield, multi-cloud, regulated, large team. The page covers cluster architecture, every object kind, deployment on AWS / GCP / Azure / vSphere, and building real projects.
OpenShift	Red Hat’s opinionated Kubernetes distribution. Enterprise estates with paid support and an integrated developer surface.
Nomad	HashiCorp’s simpler scheduler. Handles containers, raw binaries, and VMs from one control plane. Right when Kubernetes is overkill.
Docker Swarm	Docker Swarm. Built into Docker; minimum ceremony; small fleets and labs.
ECS	AWS-native. Fargate or EC2 backing. The path of least resistance inside an AWS-only estate.
Mesos	Apache Mesos. Mostly legacy in 2026 (project archived 2021), but still present on long-lived data and HPC clusters.

Picking one#

Default to Kubernetes for new infrastructure. The ecosystem (operators, CI/CD, observability, security tooling, talent pool) is the largest by a wide margin.
Pick Nomad when the workload mix is heterogeneous (containers plus legacy binaries plus VMs) and the team is small.
Pick Swarm for labs, single-host setups, and when the operator wants docker compose semantics across two or three nodes.
Pick ECS inside an AWS-only estate where Fargate’s pay-per-pod model is attractive and the operator does not want to manage cluster upgrades.
Pick OpenShift when an organization needs paid support, FIPS builds, or the Red Hat security posture.
Pick Mesos essentially never for new work; understand it on acquired estates.

For the deeper Kubernetes treatment (architecture, every object kind, deployment options across providers, building real projects), the pages under Kubernetes are the primary content.

Kubernetes

The standard. Greenfield, multi-cloud, regulated, large team. Architecture, objects, providers, projects.

Kubernetes

OpenShift

Red Hat’s opinionated Kubernetes distribution. Enterprise estates with paid support.

OpenShift

Nomad

HashiCorp’s simpler scheduler. Containers, raw binaries, and VMs from one control plane.

Nomad

Swarm

Built into Docker. Minimum ceremony, small fleets, labs.

Docker Swarm