Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →In Kubernetes, three separate settings and behaviors determine what happens when a containerized workload runs and stops: the process namespace determines which processes have which visible PIDs, the runtime’s stop behavior determines which signal reaches a container’s main process, and mount propagation determines which mount events cross a container boundary. They are related operational concerns, but none is a substitute for the others.
The examples below follow the Kubernetes v1.36 Pod API documentation for the 30-second termination-grace default. Runtime behavior and some features vary by version, so check your cluster’s release and container runtime before relying on a particular stop signal or mount behavior.
As an Amazon Associate I earn from qualifying purchases.
What changes when a Pod is deleted?
Pod deletion begins a graceful termination window. The kubelet asks the container runtime to stop the Pod’s containers; typically, the runtime sends TERM (SIGTERM) to each container’s main process. Processes still running when the grace period expires are killed. The stop requests are handled asynchronously, and Kubernetes does not guarantee an ordering among ordinary containers’ stop requests. Kubernetes Pod Lifecycle
The Pod API reference for Kubernetes v1.36 lists terminationGracePeriodSeconds as 30 seconds by default. A value of zero means there is no opportunity for graceful shutdown. Kubernetes v1.36 Pod API
Include the preStop hook in the shutdown budget
A preStop lifecycle hook runs before the stop signal and uses time from the same grace period. Plan for the hook’s duration plus the time the application needs to drain work and clean up. If those activities exceed the configured window, the process can be killed before it finishes. Kubernetes’ Pod Lifecycle documentation says: “If the preStop hook needs longer to complete than the default grace period allows, you must modify terminationGracePeriodSeconds to suit this.” Kubernetes Pod Lifecycle
The stop signal depends on the runtime and image
SIGTERM is common, not an unconditional promise for every image and runtime combination. Many container runtimes respect an image’s STOPSIGNAL. Kubernetes documents SIGTERM as the default for containerd and CRI-O when no image stop signal is defined. Confirm the behavior for the runtime and image you deploy rather than assuming every container receives the same signal.
Custom lifecycle stop signals are an alpha feature in Kubernetes v1.33, disabled by default. Using them requires the ContainerStopSignals feature gate and setting spec.os.name in the Pod. Do not treat this as generally available behavior or apply the v1.33 instructions to another release without checking its documentation. Kubernetes Pod Lifecycle
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Why is my application not PID 1?
By default, containers have separate process namespaces. With shareProcessNamespace: true, processes are visible and can be signaled across containers in the same Pod. The first process in each container is no longer PID 1; code or scripts that assume their own main process has PID 1 can therefore behave unexpectedly. Kubernetes cautions that commands making that assumption may act on the Pod sandbox instead. Share Process Namespace between Containers in a Pod
Visibility also changes the confidentiality boundary
Process sharing can help with debugging, but it exposes information to peer containers. Kubernetes notes that details in /proc, including process arguments and environment variables, may be visible subject to ordinary Unix permissions. A peer may also reach a container’s filesystem through /proc/$pid/root, subject to filesystem permissions. Enable process sharing only when that visibility is acceptable for every container in the Pod. Share Process Namespace between Containers in a Pod
This setting shares processes within a Pod; it is not the same as host PID sharing. The Pod API does not allow HostPID and ShareProcessNamespace to be set together. Kubernetes v1.36 Pod API
Rank #4
What does mountPropagation do?
mountPropagation on a container’s volume mount controls whether mount events are shared between the host and the container. It changes mount visibility, not process visibility or shutdown signals.
| Setting | Mount-event direction | Meaning and qualification |
|---|---|---|
None |
No propagation | The default. The container does not receive subsequent host mounts through the mount, and mounts created by the container are not exposed to the host. |
HostToContainer |
Host to container | Host-side mount events become visible in the container. |
Bidirectional |
Host to container and container toward host | Container mount events can propagate back toward the host. It is restricted to privileged containers; incorrect use can damage the host operating system. |
These behaviors are documented in Kubernetes Volumes: Mount propagation. Configure the field under containers[*].volumeMounts[*].mountPropagation.
Best Value
- Kubernetes is an open platform that automates container orchestration, enabling seamless deployment, automatic scaling, self-healing, and efficient management of applications across servers or clouds with high availability and optimal resource use
- Kubernetes is perfect for development operations engineers, cloud architects, site reliability engineers, platform engineering teams and infrastructure specialists who build, operate and maintain modern containerized applications in production environments
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
Use only with supported volume types and a clear need
Kubernetes warns that propagation is low-level and does not work consistently across all volume types. Its documentation recommends using it only with hostPath or a memory-backed emptyDir. With Bidirectional, the container must unmount mounts it created before it terminates; otherwise, mount cleanup can leave operational problems. Kubernetes Volumes: Mount propagation
A related read-only caveat matters when evaluating mount exposure: a read-only mount is not recursively read-only by default, so nested submounts may remain writable. Do not infer that every mount beneath a read-only parent is protected. Kubernetes Volumes: Mount propagation
How to choose the right configuration
- For graceful application shutdown: Size
terminationGracePeriodSecondsfor the combined hook, drain, and cleanup time; verify the image and runtime’s stop-signal behavior. - For debugging across containers in one Pod: Consider
shareProcessNamespace: trueonly after accepting its process and filesystem visibility implications. - For host-created mounts that a container must see: Consider
HostToContaineron a supported volume type. - For mounts created in a container that must reach the host: Use
Bidirectionalonly for a specific operational requirement, with a privileged container and a plan to unmount created mounts.
Before applying any of these settings, identify the cluster’s Kubernetes release, operating system, container runtime, and volume type. The same manifest does not establish identical runtime behavior across all cluster configurations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
