*   Update CRI to kubernetes v1.9.
    *   Bug fixes in validation test suites.
*   [beta] [cri-containerd](https://github.com/kubernetes-incubator/cri-containerd): CRI implementation for containerd is now v1.0.0-beta.0, [[@Random-Liu](https://github.com/Random-Liu)]
    *   This release supports Kubernetes 1.9+ and containerd v1.0.0+.
    *   Pass all Kubernetes 1.9 e2e test, node e2e test and CRI validation tests.

#   TF uses hub.docker.com/r/tensorflow/build containers for CI,
#   and scripts on Linux create a persistent container called "tf"
#   which mounts your TensorFlow directory into the container.
#
#   Important: because the container is persistent, you cannot change TFCI
#   variables in between script executions. To forcibly remove the
#   container and start fresh, run "docker rm -f tf". Removing the container

上のデプロイメントのコンセプトのリストから、ワーカーを使うことは主に**レプリケーション**の部分と、**再起動**を少し助けてくれますが、それ以外については引き続き対処が必要です：

* **セキュリティ - HTTPS**
* **起動時の実行**
* ***再起動***
* レプリケーション（実行中のプロセス数）
* **メモリ**
* **開始前の事前ステップ**

## コンテナとDocker { #containers-and-docker }

次章の[コンテナ内のFastAPI - Docker](docker.md)では、その他の**デプロイメントのコンセプト**を扱うために使える戦略をいくつか説明します。

単一のUvicornプロセスを実行するために、**ゼロから独自のイメージを構築する**方法も紹介します。これは簡単なプロセスで、**Kubernetes**のような分散コンテナ管理システムを使う場合に、おそらくやりたいことでしょう。

- kube-dns add-on:
  - All containers are now being executed under more restrictive privileges.
  - Most of the containers now run as non-root user and has the root filesystem set as read-only.
  - The remaining container running as root only has the minimum Linux capabilities it requires to run.

    public static final int GENERIC_READ = 0x80000000; // 31

    /** Inheritance flag: child objects inherit this ACE */
    public static final int FLAGS_OBJECT_INHERIT = 0x01;
    /** Inheritance flag: child containers inherit this ACE */
    public static final int FLAGS_CONTAINER_INHERIT = 0x02;
    /** Inheritance flag: inheritance stops after one level */
    public static final int FLAGS_NO_PROPAGATE = 0x04;

* Kubelet now proxies container streaming between apiserver and container runtime. The connection between kubelet and apiserver is authenticated. Container runtime should change streaming server to serve on localhost, to make the connection between kubelet and container runtime local. ([#64006](https://github.com/kubernetes/kubernetes/pull/64006), [@Random-Liu](https://github.com/Random-Liu))

```

Complete documentation for building Docker containers, managing custom images, or loading images into orchestration platforms is out of scope for this documentation.
You can modify the `Dockerfile` and `dockerscripts/docker-entrypoint.sh` as-needed to reflect your specific image requirements.

- github.com/containerd/containerd/api: [v1.8.0 → v1.9.0](https://github.com/containerd/containerd/compare/api/v1.8.0...api/v1.9.0)
- github.com/containerd/ttrpc: [v1.2.6 → v1.2.7](https://github.com/containerd/ttrpc/compare/v1.2.6...v1.2.7)
- github.com/containerd/typeurl/v2: [v2.2.2 → v2.2.3](https://github.com/containerd/typeurl/compare/v2.2.2...v2.2.3)

// Some TF ops need a step container to be set to limit the lifetime of some
// resources (mostly TensorArray and Stack, used in while loop gradients in
// graph mode). Calling this on a context tells it to start a step.
TF_CAPI_EXPORT extern void TFE_ContextStartStep(TFE_Context* ctx);

// Ends a step. When there is no active step (that is, every started step has
// been ended) step containers will be cleared. Note: it is not safe to call

### Ephemeral Containers Graduate to Stable