- all the k8s pieces to scale nodes, cluster, and overflow to ACI
- it does the orchestration, including config, secrets, etc
- intelligent aggregation and reporting of problems, including throttling
- best practices
- use alpine, don't cache packages, don't run as root, only allow node to access port 80
- action to scan docker container for vulnerabilities