percontainer

Percontainer is a term used in containerization to describe the management and enforcement of resources, security, and networking policies on an individual container basis, rather than applying them at the host level or to larger aggregates such as pods or applications. It emphasizes fine-grained control for each container in a mixed workload environment.

Key aspects commonly associated with percontainer practice include resource isolation and quotas (such as CPU and memory limits), I/O and storage quotas, and security contexts (including Linux capabilities, seccomp, AppArmor or SELinux profiles). Networking is also managed on a per-container basis through separate network namespaces, virtual interfaces, and, where supported, per-container policies that govern ingress and egress traffic. Observability and auditing can be scoped at the container level to track usage and security events for individual containers.

Implementation typically relies on foundational Linux features and container runtimes. Cgroups and namespaces provide isolation and resource tracking at the container level. Docker, containerd, and other runtimes create separate isolation domains per container; Kubernetes enforces per-container resource requests and limits within a Pod, and uses per-container security contexts and, when available, per-container network policies. Some environments extend percontainer controls with policy engines or admission controllers that enforce additional constraints for each container as it is created or updated.

Benefits of the percontainer approach include more predictable performance, stronger isolation, and greater flexibility in mixed-workload environments. Challenges involve increased management overhead, the need for consistent policy governance across many containers, and potential complexity in inter-container communications or shared resources.

See also: containerization, Kubernetes, cgroups, namespaces, seccomp, AppArmor.