<p>Whenever i do a &quot;docker ps -a&quot;, i see two containers corresponding to pod, here the pod has only container. Typically, the two containers listed under &quot;docker ps&quot; has the following prefixes:-
<strong>k8s_POD_kubernetes-&lt;POD_NAME&gt; and k8s_kubernetes-&lt;POD_NAME&gt;</strong></p>
<p>Can someone help me understand why we see two entries in &quot;docker ps&quot; ?</p>

Hemanth
<p>The <code>_POD_</code> one is the only one with the Pod's IP address, the others are every <em>workload</em> container from the PodSpec's <code>container:</code> and <code>initContainer:</code> arrays, since one of the contracts of Kubernetes is that <a href="https://kubernetes.io/docs/concepts/workloads/pods/#workload-resources-for-managing-pods" rel="nofollow noreferrer">all containers in a Pod share the same network identity</a></p>
<p>The nitty gritty of that involves the different namespaces in the Linux kernel that make &quot;containers&quot; operate, with cgroups for cpu, memory, process ids, and network stack. Just like <code>nsenter</code> allows the host to temporarily switch its cgroup into a container's cgroup, so does the container runtime mechanism have the &quot;sibling&quot; containers in a Pod switch into the allocated networking cgroup of that &quot;sandbox&quot; container, otherwise traffic sent from <code>container[0]</code> and <code>container[1]</code> would appear as different hosts, violating that network identity promise</p>
<p>That's also why a container within a Pod can restart without the Pod losing its IP address and <code>.metadata.name</code> because only the workload containers are restarted, the <code>_POD_</code> version remains running. It's also why you'll always see <a href="https://github.com/kubernetes-sigs/kind/blob/v0.12.0/images/base/files/etc/containerd/config.toml#L30" rel="nofollow noreferrer"><code>k8s.gcr.io/pause</code> images</a> in your Node's <code>docker images</code> list, because that container is designed to &quot;do nothing&quot; except exist</p>
