Practice Now
Kubernetes
Docker
Pod
Command-line
Container Management

How to pass docker run parameter via kubernetes pod

System Design practice on Codemia

Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.

Practice system design
KubernetesDocker & Containers

Introduction

Docker docker run parameters map to specific fields in a Kubernetes Pod spec. Environment variables use env, port mappings use containerPort (with a Service for external exposure), volume mounts use volumes + volumeMounts, the entrypoint maps to command, and CMD maps to args. There is no direct equivalent of --privileged or --network host at the docker run level — these require securityContext and hostNetwork fields in the Pod spec.

Docker vs Kubernetes Mapping

Docker RunKubernetes Pod Spec
docker run imagespec.containers[].image
-e KEY=VALUEspec.containers[].env
-p 8080:80spec.containers[].ports + Service
-v /host:/containerspec.volumes + spec.containers[].volumeMounts
--namemetadata.name
--entrypointspec.containers[].command
CMDspec.containers[].args
--restart alwaysspec.restartPolicy
--memory 512mspec.containers[].resources.limits.memory
--cpus 2spec.containers[].resources.limits.cpu
--privilegedspec.containers[].securityContext.privileged
--network hostspec.hostNetwork: true

Environment Variables

yaml
1# Docker: docker run -e DB_HOST=localhost -e DB_PORT=5432 myimage
2apiVersion: v1
3kind: Pod
4metadata:
5  name: my-app
6spec:
7  containers:
8    - name: my-app
9      image: myimage
10      env:
11        - name: DB_HOST
12          value: "localhost"
13        - name: DB_PORT
14          value: "5432"
15        # From a ConfigMap
16        - name: APP_CONFIG
17          valueFrom:
18            configMapKeyRef:
19              name: app-config
20              key: setting
21        # From a Secret
22        - name: DB_PASSWORD
23          valueFrom:
24            secretKeyRef:
25              name: db-secret
26              key: password

Command and Arguments

yaml
1# Docker: docker run myimage --config /etc/app.yaml --verbose
2# Docker: docker run --entrypoint /bin/sh myimage -c "echo hello"
3
4apiVersion: v1
5kind: Pod
6metadata:
7  name: my-app
8spec:
9  containers:
10    - name: my-app
11      image: myimage
12      # command overrides Docker ENTRYPOINT
13      command: ["/bin/sh"]
14      # args overrides Docker CMD
15      args: ["-c", "echo hello"]
16
17---
18# Just override CMD (keep default ENTRYPOINT)
19apiVersion: v1
20kind: Pod
21metadata:
22  name: my-app
23spec:
24  containers:
25    - name: my-app
26      image: myimage
27      args: ["--config", "/etc/app.yaml", "--verbose"]

Port Mapping

yaml
1# Docker: docker run -p 8080:80 myimage
2
3apiVersion: v1
4kind: Pod
5metadata:
6  name: my-app
7  labels:
8    app: my-app
9spec:
10  containers:
11    - name: my-app
12      image: myimage
13      ports:
14        - containerPort: 80  # The port the container listens on
15
16---
17# Expose externally via a Service (equivalent of -p host:container)
18apiVersion: v1
19kind: Service
20metadata:
21  name: my-app-service
22spec:
23  selector:
24    app: my-app
25  ports:
26    - port: 8080        # Service port (external)
27      targetPort: 80     # Container port
28  type: NodePort         # Or LoadBalancer for cloud

Volume Mounts

yaml
1# Docker: docker run -v /host/data:/app/data -v config:/app/config myimage
2
3apiVersion: v1
4kind: Pod
5metadata:
6  name: my-app
7spec:
8  containers:
9    - name: my-app
10      image: myimage
11      volumeMounts:
12        - name: data-volume
13          mountPath: /app/data
14        - name: config-volume
15          mountPath: /app/config
16  volumes:
17    # Host path (like Docker bind mount)
18    - name: data-volume
19      hostPath:
20        path: /host/data
21        type: DirectoryOrCreate
22    # Persistent volume (like Docker named volume)
23    - name: config-volume
24      persistentVolumeClaim:
25        claimName: config-pvc

Resource Limits

yaml
1# Docker: docker run --memory 512m --cpus 2 myimage
2
3apiVersion: v1
4kind: Pod
5metadata:
6  name: my-app
7spec:
8  containers:
9    - name: my-app
10      image: myimage
11      resources:
12        requests:
13          memory: "256Mi"
14          cpu: "500m"      # 0.5 CPU cores
15        limits:
16          memory: "512Mi"
17          cpu: "2000m"     # 2 CPU cores

Security Context

yaml
1# Docker: docker run --privileged --user 1000:1000 myimage
2# Docker: docker run --cap-add NET_ADMIN myimage
3
4apiVersion: v1
5kind: Pod
6metadata:
7  name: my-app
8spec:
9  securityContext:
10    runAsUser: 1000
11    runAsGroup: 1000
12    fsGroup: 1000
13  containers:
14    - name: my-app
15      image: myimage
16      securityContext:
17        privileged: false           # Avoid --privileged in production
18        capabilities:
19          add: ["NET_ADMIN"]        # --cap-add equivalent
20          drop: ["ALL"]             # Drop all capabilities first
21        readOnlyRootFilesystem: true

Restart Policy and Health Checks

yaml
1# Docker: docker run --restart always --health-cmd "curl -f http://localhost" myimage
2
3apiVersion: v1
4kind: Pod
5metadata:
6  name: my-app
7spec:
8  restartPolicy: Always  # Always, OnFailure, or Never
9  containers:
10    - name: my-app
11      image: myimage
12      livenessProbe:
13        httpGet:
14          path: /health
15          port: 80
16        initialDelaySeconds: 10
17        periodSeconds: 30
18      readinessProbe:
19        httpGet:
20          path: /ready
21          port: 80
22        initialDelaySeconds: 5
23        periodSeconds: 10

Common Pitfalls

  • Confusing command and args: In Kubernetes, command overrides the Docker ENTRYPOINT and args overrides CMD. Setting only command replaces the entrypoint but also clears the default CMD. If you just want to pass arguments to the existing entrypoint, use args only and omit command.
  • Expecting -p port mapping to work the same way: Docker's -p 8080:80 maps a host port directly. Kubernetes containerPort only declares which port the container uses — it does not expose it externally. You need a Service (NodePort, LoadBalancer, or Ingress) to make the port accessible outside the cluster.
  • Using hostPath volumes in production: hostPath is the Kubernetes equivalent of Docker bind mounts, but it ties the Pod to a specific node. In production, use PersistentVolumeClaim with a storage class for portability across nodes.
  • Setting privileged: true without understanding the risk: The --privileged Docker flag gives the container full access to the host. In Kubernetes, securityContext.privileged: true does the same. Use capabilities.add to grant only the specific capabilities needed instead.
  • Forgetting that environment variable values must be strings: In Kubernetes YAML, all env values must be strings. value: 5432 (without quotes) is parsed as an integer and causes an error. Always quote numeric values: value: "5432".

Summary

  • Docker --entrypoint maps to command, Docker CMD maps to args in Pod spec
  • Environment variables use env with support for ConfigMaps and Secrets
  • Port exposure requires both containerPort in the Pod and a Service for external access
  • Volume mounts use volumes + volumeMounts — prefer PersistentVolumeClaims over hostPath
  • Resource limits (--memory, --cpus) map to resources.requests and resources.limits
Related reading
Course
Beginner
27 lessons
10 hours
System Design Fundamentals

Build a strong foundation in designing scalable, reliable distributed systems.

View the course
Track what you have practised

A free account saves your progress, solutions and study plan across every problem on Codemia.

System Design practice on Codemia

Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.

Practice system design
Codemia
© 2026 Codemia
Resources
Legal
Social
All Rights Reserved.