{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/use-kubernetes-restartable-sidecars-with-an-explicit-shutdown-plan/", "item": { "id": "https://update.dsesecurity.com/updates/use-kubernetes-restartable-sidecars-with-an-explicit-shutdown-plan/", "slug": "use-kubernetes-restartable-sidecars-with-an-explicit-shutdown-plan", "url": "https://update.dsesecurity.com/updates/use-kubernetes-restartable-sidecars-with-an-explicit-shutdown-plan/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/use-kubernetes-restartable-sidecars-with-an-explicit-shutdown-plan.md", "json": "https://update.dsesecurity.com/api/v1/posts/use-kubernetes-restartable-sidecars-with-an-explicit-shutdown-plan/" }, "title": "Use Kubernetes restartable sidecars with an explicit shutdown plan", "summary": "A helper’s location in the Pod specification affects completion and termination behavior.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:14:40+00:00", "modified_at": "2026-10-20T18:34:31+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 250, "potentially_affected": "Review restartable init sidecars, their shutdown sequence and their effect on Job completion.", "dse_recommendation": "DSE recommends documenting which helpers must remain available during application shutdown.", "primary_source": { "name": "Kubernetes documentation — Sidecar Containers", "url": "https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/", "published_on": null, "authority": "kubernetes.io" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A helper’s location in the Pod specification affects completion and termination behavior.

\n

Source facts

\n

Kubernetes supports restartable sidecars through init containers configured with restartPolicy set to Always. They can run alongside the application. During Pod termination, the kubelet waits for main application containers to stop before terminating these sidecars in reverse declaration order. A sidecar implemented this way does not prevent a Job from completing after its main container finishes.

\n

Source: Kubernetes documentation — Sidecar Containers.

\n

Applicability

\n

Review restartable init sidecars, their shutdown sequence and their effect on Job completion.

\n

DSE recommendation

\n

DSE recommends documenting which helpers must remain available during application shutdown. Put log shipping, proxy shutdown, and buffered output requirements into the application’s termination design rather than relying on an assumed simultaneous stop. Distinguish the helper’s health from the main process’s completion criterion. Keep enough termination time for the intended sequence and consider what happens when the application consumes that time. Do not use the presence of a sidecar as evidence that its final output was delivered.

\n

Verification

\n

In an approved test Job, record main-container completion and sidecar termination order. Repeat with a deliberately slow application shutdown and inspect whether the required final records arrive. Retain the observations before changing the production Pod template. Have the helper owner define the final message or buffered item that should arrive. Compare that application result with the termination timeline, rather than accepting an exited container as the only success criterion.

\n

Official reference

\n

Kubernetes documentation — Sidecar Containers. Reviewed October 20, 2026.

", "content_text": "A helper’s location in the Pod specification affects completion and termination behavior.\nSource facts\nKubernetes supports restartable sidecars through init containers configured with restartPolicy set to Always. They can run alongside the application. During Pod termination, the kubelet waits for main application containers to stop before terminating these sidecars in reverse declaration order. A sidecar implemented this way does not prevent a Job from completing after its main container finishes.\nSource: Kubernetes documentation — Sidecar Containers.\nApplicability\nReview restartable init sidecars, their shutdown sequence and their effect on Job completion.\nDSE recommendation\nDSE recommends documenting which helpers must remain available during application shutdown. Put log shipping, proxy shutdown, and buffered output requirements into the application’s termination design rather than relying on an assumed simultaneous stop. Distinguish the helper’s health from the main process’s completion criterion. Keep enough termination time for the intended sequence and consider what happens when the application consumes that time. Do not use the presence of a sidecar as evidence that its final output was delivered.\nVerification\nIn an approved test Job, record main-container completion and sidecar termination order. Repeat with a deliberately slow application shutdown and inspect whether the required final records arrive. Retain the observations before changing the production Pod template. Have the helper owner define the final message or buffered item that should arrive. Compare that application result with the termination timeline, rather than accepting an exited container as the only success criterion.\nOfficial reference\nKubernetes documentation — Sidecar Containers. Reviewed October 20, 2026.", "content_markdown": "A helper’s location in the Pod specification affects completion and termination behavior.\n\n## Source facts\n\nKubernetes supports restartable sidecars through init containers configured with restartPolicy set to Always. They can run alongside the application. During Pod termination, the kubelet waits for main application containers to stop before terminating these sidecars in reverse declaration order. A sidecar implemented this way does not prevent a Job from completing after its main container finishes.\n\nSource: [Kubernetes documentation — Sidecar Containers](https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/).\n\n## Applicability\n\nReview restartable init sidecars, their shutdown sequence and their effect on Job completion.\n\n## DSE recommendation\n\nDSE recommends documenting which helpers must remain available during application shutdown. Put log shipping, proxy shutdown, and buffered output requirements into the application’s termination design rather than relying on an assumed simultaneous stop. Distinguish the helper’s health from the main process’s completion criterion. Keep enough termination time for the intended sequence and consider what happens when the application consumes that time. Do not use the presence of a sidecar as evidence that its final output was delivered.\n\n## Verification\n\nIn an approved test Job, record main-container completion and sidecar termination order. Repeat with a deliberately slow application shutdown and inspect whether the required final records arrive. Retain the observations before changing the production Pod template. Have the helper owner define the final message or buffered item that should arrive. Compare that application result with the termination timeline, rather than accepting an exited container as the only success criterion.\n\n## Official reference\n\n[Kubernetes documentation — Sidecar Containers](https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/use-kubernetes-restartable-sidecars-with-an-explicit-shutdown-plan/", "url": "https://update.dsesecurity.com/updates/use-kubernetes-restartable-sidecars-with-an-explicit-shutdown-plan/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/use-kubernetes-restartable-sidecars-with-an-explicit-shutdown-plan/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "IT", "item": "https://update.dsesecurity.com/topic/it/" }, { "@type": "ListItem", "position": 3, "name": "Use Kubernetes restartable sidecars with an explicit shutdown plan", "item": "https://update.dsesecurity.com/updates/use-kubernetes-restartable-sidecars-with-an-explicit-shutdown-plan/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/use-kubernetes-restartable-sidecars-with-an-explicit-shutdown-plan/#article", "identifier": "https://update.dsesecurity.com/updates/use-kubernetes-restartable-sidecars-with-an-explicit-shutdown-plan/", "url": "https://update.dsesecurity.com/updates/use-kubernetes-restartable-sidecars-with-an-explicit-shutdown-plan/", "headline": "Use Kubernetes restartable sidecars with an explicit shutdown plan", "description": "A helper’s location in the Pod specification affects completion and termination behavior.", "abstract": "A helper’s location in the Pod specification affects completion and termination behavior.", "articleBody": "A helper’s location in the Pod specification affects completion and termination behavior.\nSource facts\nKubernetes supports restartable sidecars through init containers configured with restartPolicy set to Always. They can run alongside the application. During Pod termination, the kubelet waits for main application containers to stop before terminating these sidecars in reverse declaration order. A sidecar implemented this way does not prevent a Job from completing after its main container finishes.\nSource: Kubernetes documentation — Sidecar Containers.\nApplicability\nReview restartable init sidecars, their shutdown sequence and their effect on Job completion.\nDSE recommendation\nDSE recommends documenting which helpers must remain available during application shutdown. Put log shipping, proxy shutdown, and buffered output requirements into the application’s termination design rather than relying on an assumed simultaneous stop. Distinguish the helper’s health from the main process’s completion criterion. Keep enough termination time for the intended sequence and consider what happens when the application consumes that time. Do not use the presence of a sidecar as evidence that its final output was delivered.\nVerification\nIn an approved test Job, record main-container completion and sidecar termination order. Repeat with a deliberately slow application shutdown and inspect whether the required final records arrive. Retain the observations before changing the production Pod template. Have the helper owner define the final message or buffered item that should arrive. Compare that application result with the termination timeline, rather than accepting an exited container as the only success criterion.\nOfficial reference\nKubernetes documentation — Sidecar Containers. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:14:40+00:00", "dateModified": "2026-10-20T18:34:31+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/use-kubernetes-restartable-sidecars-with-an-explicit-shutdown-plan/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/use-kubernetes-restartable-sidecars-with-an-explicit-shutdown-plan/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Use Kubernetes restartable sidecars with an explicit shutdown plan" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 250, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Kubernetes documentation — Sidecar Containers", "url": "https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/" } } ] } }