Containers, Kubernetes, Ephemeral Injectors, and Infrastructure Automation: Configuration, Design Patterns, and Trade-Offs

1. Custom Apache-binary image versus community JMeter image

2. Baked assets versus mounted versioned assets

Mandatory lab: JMeter runtime is baked; JMX/config/synthetic CSV are mounted and hashed. Plugins would normally be baked and versioned because plugin binary drift changes execution semantics.

3. Docker Compose versus Kubernetes Job

4. One large injector versus multiple injectors

Chapter 26 says measure one injector's usable capacity; Chapter 25 says distributed configured load is the sum of full plans. Containers do not change either rule.

Example: one Pod at 20 threads may hit its 500m CPU limit; two Pods at 10 threads each configure the same 20 total threads but have two independent JVMs, two DNS/socket pools and two resource limits. Compare generator overhead and target source/network behavior—do not assume they are equivalent.

5. Kubernetes Job load math and retries

The optional checkpoint Job uses completions=2, parallelism=2. Each Pod executes 5 threads ×20 loops =100 samples, so configured total =200. It also uses backoffLimit=0 and a 90-second active deadline to avoid automatic workload retries in the teaching run.

Kubernetes documentation warns Jobs can recreate Pods after failures. For real destructive/non-idempotent targets, retry semantics must be included in safety/load math. Target count remains the final achieved-work check.

6. Artifact volume versus remote telemetry

7. Compose pattern

Compose is useful when the fixture and injector should be described in one local file. Preserve the same rules: exact image tags/IDs, private network, read-only inputs, writable artifacts, explicit CPU/memory, no latest, and a health/preflight gate. depends_on ordering alone is not evidence that the target is ready.

8. Resource limits versus JVM heap

A container memory limit is broader than Java heap: metaspace, direct buffers, thread stacks, native libraries and kernel/socket state also consume resources. Set -Xmx comfortably below the container limit and profile Chapter 26 metrics inside that cgroup/quota. CPU limits can throttle JMeter even when host CPU is low.

9. Non-root image versus bind-mount ownership

Running the injector as non-root reduces container privilege, but Linux bind-mounted result directories must be writable by the container UID/GID or by an intentional override such as --user "$(id -u):$(id -g)". Do not “fix” every permission issue with chmod 777 or root.

10. Namespace/service DNS versus host network

User-defined Docker networks and Kubernetes Services make target identity explicit. Host networking may reduce namespace translation on some Linux setups, but it weakens isolation/port separation and is not portable to Docker Desktop in the same way. Mandatory path stays bridge/Service DNS and measures the resulting environment.

11. Configuration-layer boundaries

12. Worked scenario

You need 1,000 total configured threads. Chapter 26 proved one container under 1 CPU/768 MiB is valid only to 120 threads. Should one Kubernetes Pod be set to 1,000 threads because the node has enough total CPU?

No. The measured injector/JVM quota is the relevant capacity. Use a bounded number of measured injectors and calculate the sum—for example eight ×120 =960 plus a separately justified remainder—while accounting for additional JVM/network/result overhead. Do not let horizontal scaling bypass target authorization.

13. Decision table

14. Configured versus achieved load

Configured load = sum of every running injector's Thread Group workload plus any orchestrator retries/restarts that actually rerun the process. Achieved load = target-observed and JTL-observed samples under valid generator/container headroom. Preserve image/input identities, resource limits, Pod/container count and exit/restart state before making target-capacity claims.

Knowledge check

Official references and version notes

• Apache JMeter downloads — JMeter 5.6.3, Java requirement, SHA-512/PGP integrity verification.
• Apache-published JMeter 5.6.3 SHA-512 — checksum used by the lab Dockerfile.
• Eclipse Temurin Docker Official Image — version-specific Java 17.0.20+8 JRE base used by the custom injector image.
• Docker bind mounts — read-only input mounts and writable host artifact mounts.
• Docker run reference — read-only root filesystem, CPU/memory limits, mounts, networks and exit-state inspection.
• Kubernetes Jobs — run-to-completion semantics, parallelism/completions, restartPolicy, backoff and active deadlines.
• kind Quick Start — local cluster lifecycle and loading locally built images.