Why are multiple processes not started in a single container?

This violates the principle of "one process per container," which is a cornerstone of containerization for achieving maximum isolation and manageability.

Reasons:

• Isolation and lifecycle management: A container should be responsible for a single specific process. This simplifies management, scaling, and orchestration. If one process in the container crashes, the entire container can be restarted, which leads to unnecessary restarts of other running processes. Orchestrators (Kubernetes, Docker Swarm) are designed to manage individual processes within containers.
• Logging and monitoring: Collecting logs and metrics for multiple processes in one container is more difficult. Each process has its own output stream (stdout/stderr). Separating processes into different containers makes it easier to collect and analyze data.
• Security: Process-level isolation enhances security. If one process is compromised, the potential impact on the system is limited to that container. When multiple processes run in one container, a compromised process may have access to others.
• Updating and debugging: Updating and debugging individual components (processes) is much easier if they are in different containers. You can update or restart a specific container without affecting other services.
• Image size: The container image becomes smaller and more specialized if it contains only the files necessary for one process.
• Complexity of ENTRYPOINT/CMD: Proper management of multiple processes in ENTRYPOINT or CMD requires writing complex wrappers (init systems like tini or supervisord), which adds unnecessary complexity.

Example of a Dockerfile for a single process:

FROM alpine:latest
CMD ["nginx", "-g", "daemon off;"] // Runs only nginx

Poor example with multiple processes:

FROM ubuntu:latest
COPY start.sh /start.sh
CMD ["/start.sh"] // start.sh tries to run multiple processes

In start.sh, you would need to implement lifecycle management logic, which essentially duplicates the functionality of an orchestrator.

In rare cases, for auxiliary processes (e.g., sshd for debugging), an init system inside the container can be used, but this is an exception, not the rule. The main idea is one main process per container.