What is Sidecar?

A sidecar is a secondary container that runs in the same pod as the primary application container within a Kubernetes or similar container orchestration environment. It shares the pod's network namespace, storage volumes, and lifecycle, enabling it to intercept traffic, collect logs, or manage configuration without modifying the main application code.

The sidecar pattern works by deploying an additional container that communicates with the primary container via localhost or shared filesystem volumes. For example, a sidecar can run an Envoy proxy to handle service mesh traffic, a Fluentd agent to forward logs to a central system, or a Vault agent to inject secrets. The sidecar is started and stopped together with the main container, and both are scheduled on the same node, ensuring tight coupling and minimal latency.

In the wider container architecture, the sidecar pattern is a core design principle for service meshes (e.g., Istio, Linkerd) and observability stacks. It decouples cross-cutting concerns from business logic, allowing teams to update infrastructure components independently. The pattern is defined in Kubernetes as part of the pod specification, where multiple containers share the same pod. Sidecars are distinct from init containers, which run to completion before the main container starts, whereas sidecars run continuously alongside the main container.