Sidecar container
A helper container that runs in the same pod as the main application and extends it with functionality — logging, a proxy, security — without the application itself needing to change. The central pattern behind service meshes.
Mechanic: containers in the same pod share the network (same IP/localhost) and can share volumes, which lets a sidecar capture the main app's traffic or read its logs transparently. Classic use cases: an Envoy proxy that handles all in/outbound traffic (a service mesh like Istio/Linkerd), a log shipper that forwards logs, or a container that fetches secrets. Win: separation of concerns — the app focuses on its logic, the sidecar handles cross-cutting needs, and you can update them independently. Trade-off: more containers = more resource overhead per pod, which drove "sidecar-less" meshes (eBPF) and Kubernetes' built-in sidecar support (as an init container with a restartPolicy). A foundational pattern in cloud-native architecture. Related to service mesh sidecar and init container.