Deploying Grid with Containers, Kubernetes, and Cloud Infrastructure: Core Concepts and Mental Model

1. Why “it works locally” changes when the browser moves into a container

A local browser shares the test runner’s machine namespace. A containerized browser does not. The browser now resolves DNS, opens TCP connections, writes downloads, consumes shared memory, and emits logs from a separate runtime boundary. A test can therefore fail before Selenium ever reaches a locator.

2. The deployment path and trust boundaries

flowchart TD
 T[Test runner / CI] -->|WebDriver HTTP| G[Grid endpoint :4444]
 G --> N[Browser Node container / pod]
 N -->|AUT HTTP/TLS| A[Application under test]
 N --> E[Ephemeral browser/profile state]
 N --> F[Optional artifacts / video / logs]
 O[Docker / Kubernetes] -->|start, stop, restart, limits| G
 O -->|start, stop, restart, limits| N
 S[Secrets / registry / network policy] --> O

The test client owns test intent and credentials. Grid owns session routing. The browser container owns browser processes and temporary profile state. Docker or Kubernetes owns process isolation, networks, mounts, restarts, and resource limits. Artifact stores outlive a session only when you deliberately mount or upload them. A hosted browser cloud replaces parts of this infrastructure, but it does not remove the same trust questions.

3. State stores you must not blur together

The following table organizes the key choices and evidence for State stores you must not blur together. Use it together with the surrounding prose so the rows serve as a comparison aid rather than standalone rules.

4. Read-only preflight before starting or changing Grid

The following example makes the Read-only preflight before starting or changing Grid behavior concrete. Read it with the stated assumptions, then compare its observable output or state changes with the explanation that follows.

docker version
docker compose version
docker image inspect selenium/standalone-chrome:4.47.0-20260808 --format '{{.RepoTags}} {{.Id}}' 2>/dev/null || true
# After Grid is running:
curl -fsS http://127.0.0.1:4444/status

The following example makes the Read-only preflight before starting or changing Grid behavior concrete. Read it with the stated assumptions, then compare its observable output or state changes with the explanation that follows.

import json, urllib.request

with urllib.request.urlopen("http://127.0.0.1:4444/status", timeout=3) as response:
    status = json.load(response)
print(json.dumps(status, indent=2)[:2000])

Inspect first: Docker/Compose versions, the exact image tag, Grid readiness, returned capabilities, browser version, session ID, and current URLs. Do not diagnose a browser issue while silently running a different image than the one documented in CI.

5. Version pinning: stable release tags, not floating intent

The official Docker Selenium project currently publishes 4.47.0-20260808 images. Its own README recommends full tags for reproducibility and labels nightly as test-only. A short latest tag can change Grid, browser, driver, OS, and Java together between runs.

6. Browser containers are resource workloads, not tiny utilities

The official project recommends --shm-size=2g for browser-containing images. Shared-memory pressure can look like browser crashes or renderer instability. CPU, memory, file descriptors, video encoders, downloads, and parallel sessions all compete for host resources.

7. Kubernetes and browser clouds change the operator, not the test contract

On Kubernetes, pods replace long-lived containers and Services/Ingress replace direct port publishing. The official Selenium project currently publishes Helm chart 0.58.0 using image tag 4.47.0-20260808. Managed browser clouds move browser/runtime operations to a provider. In both cases the test still needs a reachable Grid endpoint, reachable AUT, explicit capabilities, evidence correlation, secret handling, and cleanup.

8. DevOps operating model

Treat Grid images like deployable software: pin versions, review upgrades, record image/server/browser identity in CI artifacts, restrict ingress, define resource budgets, measure queue/session health, keep artifacts bounded, and rehearse rollback. A green Selenium test cannot prove the Grid deployment itself is securely operated.

Knowledge check

Official references and current-version notes

• SeleniumHQ/docker-selenium — official images, Compose, Dynamic Grid, troubleshooting
• Docker Selenium 4.47.0-20260808 release
• Official Selenium Grid Helm chart
• Selenium Grid documentation
• Grid CLI/configuration options