License & Deployment Mix: 16 tools – 9 OSS, 4 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
What Is Container Orchestration?
Container orchestration is the automated management of containerized application lifecycles – deploying, scaling, networking, load balancing, and healing containers across clusters of hosts. Orchestrators abstract away individual servers, presenting a pool of compute resources as a single platform on which workloads run.
Without orchestration, operators must manually place containers on hosts, configure networking between them, restart failed instances, and scale services by hand. Container orchestration eliminates this operational burden by declaring the desired state (e.g., “run 3 replicas of this service”) and letting the orchestrator continuously reconcile actual state to match.
Kubernetes has become the dominant standard, but lightweight distributions (K3s, K0s, MicroK8s) and alternative orchestrators (Nomad, Docker Swarm) serve different complexity and scale requirements. Managed services (EKS, GKE, AKS) offload control plane operations to cloud providers. Enterprise platforms (OpenShift, Rancher, Tanzu) add multi-cluster management, security policies, and developer workflows on top of Kubernetes.
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
SSO / OIDC Comparison
OIDC is the preferred SSO protocol.
| Tool | OIDC | SAML | SCIM | Authentik Notes |
|---|---|---|---|---|
| Kubernetes | Yes | No | No | API server --oidc-* flags; Authentik as OIDC provider; kubectl via kubelogin |
| K3s | Yes | No | No | Same K8s OIDC flags; configure in K3s server args; Authentik as IdP |
| K0s | Yes | No | No | Same K8s OIDC flags; configure in k0s.yaml; Authentik as IdP |
| MicroK8s | Yes | No | No | Same K8s OIDC flags; configure via MicroK8s args; Authentik as IdP |
| Docker Swarm | No | No | No | No API authentication beyond TLS mutual auth; no SSO for Swarm API |
| Nomad | Yes | No | No | Native OIDC auth method; Authentik as OIDC provider; CLI and UI login |
| Podman | No | No | No | CLI tool; no multi-user auth; OS-level auth only |
| OpenShift | Yes | Yes | No | Native OAuth server; Authentik as OIDC IdP; SAML federation; HTPasswd, LDAP, GitHub |
| Rancher | Yes | Yes | No | Native OIDC and SAML; Authentik as external IdP; local auth fallback |
| Portainer | Yes | No | No | Native OAuth/OIDC; Authentik as OIDC provider; LDAP also supported |
| Amazon EKS | Yes* | Yes | Yes | AWS IAM Identity Center; OIDC federation; Authentik as external SAML IdP to IAM IC |
| Google GKE | Yes* | Yes | Yes | Google Cloud Identity; Workforce Identity Federation; Authentik as external SAML/OIDC IdP |
| Azure AKS | Yes* | Yes | Yes | Entra ID (Azure AD); OIDC federation; SCIM via Entra; Authentik as external SAML IdP |
| Tanzu | Yes | Yes | No | Pinniped for OIDC/LDAP; TMC supports OIDC; Authentik as IdP |
| MKE | Yes | Yes | No | Native OIDC and SAML; LDAP/AD integration; Authentik as OIDC IdP |
* = requires cloud identity federation (not direct OIDC to K8s API server; federated through cloud IAM)
Best SSO support: OpenShift, Rancher, managed services (EKS/GKE/AKS via cloud IAM federation)
Native OIDC for K8s API: All Kubernetes distributions (upstream, K3s, K0s, MicroK8s) support OIDC tokens for API authentication via --oidc-issuer-url
No SSO: Docker Swarm (TLS only), Podman (CLI)
API Comparison
| Tool | API Type | Auth | Webhooks | SDKs |
|---|---|---|---|---|
| Kubernetes | REST (K8s API) | Bearer, OIDC, x509 | Yes (admission webhooks) | Go (client-go), Python, Java, JS, .NET, Rust |
| K3s | REST (K8s API) | Bearer, OIDC, x509 | Yes (admission webhooks) | Same as Kubernetes |
| K0s | REST (K8s API) | Bearer, OIDC, x509 | Yes (admission webhooks) | Same as Kubernetes |
| MicroK8s | REST (K8s API) | Bearer, OIDC, x509 | Yes (admission webhooks) | Same as Kubernetes |
| Docker Swarm | REST (Docker API) | TLS mutual auth | No | Go (Docker SDK), Python (docker-py) |
| Nomad | REST | ACL token, OIDC | No | Go (nomad/api), Python (community) |
| Podman | REST (compat.) | Unix socket | No | Go, Python (podman-py) |
| OpenShift | REST (K8s + OCP) | OAuth2, Bearer | Yes (admission webhooks) | Go (client-go), oc CLI |
| Rancher | REST (Rancher API + K8s) | Bearer, API key | Yes (webhooks) | Go, Python (community) |
| Portainer | REST | JWT, API key | Yes (webhooks) | None official; REST API documented |
| EKS | REST (K8s + AWS) | IAM SigV4, Bearer | Yes (EventBridge) | AWS SDKs (Python boto3, Go, JS, Java, .NET) |
| GKE | REST (K8s + GCP) | OAuth2, Bearer | Yes (Pub/Sub) | Google Cloud SDKs (Python, Go, Java, JS, .NET) |
| AKS | REST (K8s + ARM) | OAuth2 (Entra) | Yes (Event Grid) | Azure SDKs (Python, Go, JS, Java, .NET) |
| Tanzu | REST (K8s + TMC) | Bearer, OIDC | Yes (admission webhooks) | Go (client-go), TMC CLI |
| MKE | REST (K8s + MKE) | Bearer, client cert | Yes (admission webhooks) | Go (client-go), Docker SDK |
Core Orchestration Features
| Tool | Scheduling | Auto-Scaling | Self-Healing | Rolling Updates | Service Discovery | Namespaces |
|---|---|---|---|---|---|---|
| Kubernetes | Yes (advanced) | HPA, VPA, Cluster | Yes | Yes (Deployment) | DNS (CoreDNS) | Yes |
| K3s | Yes (same as K8s) | HPA, VPA, Cluster | Yes | Yes | DNS (CoreDNS) | Yes |
| K0s | Yes (same as K8s) | HPA, VPA, Cluster | Yes | Yes | DNS (CoreDNS) | Yes |
| MicroK8s | Yes (same as K8s) | HPA, VPA (add-on) | Yes | Yes | DNS (CoreDNS) | Yes |
| Docker Swarm | Yes (basic) | No native HPA | Yes (restart) | Yes (rolling) | DNS (built-in) | No (stacks) |
| Nomad | Yes (advanced) | Yes (autoscaler) | Yes (reschedule) | Yes (canary, rolling) | Consul integration | Yes |
| Podman | No (single-host) | No | No | No | No | No |
| OpenShift | Yes (same as K8s) | HPA, VPA, Cluster | Yes | Yes + DeploymentConfig | DNS (CoreDNS) | Yes (Projects) |
| Rancher | Yes (manages K8s) | HPA, VPA, Cluster | Yes | Yes | DNS (CoreDNS) | Yes |
| Portainer | Via K8s/Swarm | Via K8s | Via K8s/Swarm | Via K8s/Swarm | Via K8s/Swarm | Via K8s |
| EKS | Yes (same as K8s) | HPA, VPA, Karpenter | Yes | Yes | DNS (CoreDNS) | Yes |
| GKE | Yes (same as K8s) | HPA, VPA, Cluster (Autopilot) | Yes | Yes | DNS (kube-dns) | Yes |
| AKS | Yes (same as K8s) | HPA, VPA, Cluster | Yes | Yes | DNS (CoreDNS) | Yes |
| Tanzu | Yes (same as K8s) | HPA, VPA, Cluster | Yes | Yes | DNS (CoreDNS) | Yes |
| MKE | Yes (same as K8s) | HPA, VPA | Yes | Yes | DNS (CoreDNS) | Yes |
Networking
| Tool | CNI Support | Built-in CNI | Network Policies | Ingress | Service Mesh |
|---|---|---|---|---|---|
| Kubernetes | Yes (pluggable) | None (must install) | Via CNI plugin | Ingress/Gateway API | Istio, Linkerd, Cilium |
| K3s | Yes | Flannel (default) | Via CNI plugin | Traefik (built-in) | Istio, Linkerd |
| K0s | Yes | Calico (default) | Calico policies | User choice | Istio, Linkerd |
| MicroK8s | Yes | Calico (add-on) | Calico policies | Ingress add-on | Istio add-on |
| Docker Swarm | No (own overlay) | Overlay + Bridge | No | No native ingress | No |
| Nomad | Yes (bridge mode) | Bridge | Consul intentions | Traefik, Nginx (external) | Consul Connect |
| Podman | No (single host) | Netavark/CNI | No | N/A | N/A |
| OpenShift | Yes | OVN-Kubernetes | Yes (native) | Routes + Ingress | OpenShift Service Mesh (Istio) |
| Rancher | Yes (per cluster) | Canal (default) | Via CNI plugin | Per cluster config | Istio integration |
| Portainer | Via K8s/Swarm | Via K8s/Swarm | Via K8s | Via K8s | N/A |
| EKS | Yes | VPC CNI (default) | Calico or VPC CNI | ALB Ingress Controller | App Mesh, Istio |
| GKE | Yes | GKE CNI (Dataplane V2/Cilium) | Yes (native) | GKE Ingress (GCLB) | Anthos Service Mesh |
| AKS | Yes | Azure CNI / kubenet | Calico or Azure NPM | Ingress Controller add-on | Open Service Mesh, Istio |
| Tanzu | Yes | Antrea (default) | Antrea policies | Contour (built-in) | Istio |
| MKE | Yes | Calico (default) | Calico policies | User choice | Istio |
Storage
| Tool | CSI Support | Built-in Storage | Dynamic Provisioning | Volume Snapshots | Storage Classes |
|---|---|---|---|---|---|
| Kubernetes | Yes | None (must install) | Yes (via CSI) | Yes (via CSI) | Yes |
| K3s | Yes | local-path provisioner | Yes | Yes (via CSI) | Yes |
| K0s | Yes | None (must install) | Yes (via CSI) | Yes (via CSI) | Yes |
| MicroK8s | Yes | hostpath (add-on) | Yes (via CSI) | Yes (via CSI) | Yes |
| Docker Swarm | No | Docker volumes | No | No | No |
| Nomad | Yes | Host volumes | Yes (via CSI) | Limited | No |
| Podman | No | Podman volumes | No | No | No |
| OpenShift | Yes | None (infra-dep.) | Yes (via CSI) | Yes (via CSI) | Yes |
| Rancher | Yes (per cluster) | Longhorn (optional) | Yes (via CSI) | Yes (via CSI) | Yes |
| Portainer | Via K8s | Via K8s | Via K8s | Via K8s | Via K8s |
| EKS | Yes | EBS CSI (add-on) | Yes | Yes | Yes |
| GKE | Yes | GCE PD CSI | Yes | Yes | Yes |
| AKS | Yes | Azure Disk/File CSI | Yes | Yes | Yes |
| Tanzu | Yes | vSphere CSI | Yes | Yes | Yes |
| MKE | Yes | None (infra-dep.) | Yes (via CSI) | Yes (via CSI) | Yes |
Kubernetes Compatibility
| Tool | K8s Conformant | K8s API Version | CNCF Certified | Helm Support | kubectl Compatible |
|---|---|---|---|---|---|
| Kubernetes | Yes | Latest | Yes | Yes | Yes |
| K3s | Yes | Latest - 1 | Yes | Yes | Yes |
| K0s | Yes | Latest - 1 | Yes | Yes | Yes |
| MicroK8s | Yes | Latest - 1 | Yes | Yes (add-on) | Yes |
| Docker Swarm | No | N/A | No | No | No |
| Nomad | No | N/A | No | No | No |
| Podman | No | N/A | No | No | No (podman kube play) |
| OpenShift | Yes | Latest - 1 | Yes | Yes | Yes (oc wraps kubectl) |
| Rancher | Yes (managed) | Depends on distro | Yes (RKE2) | Yes | Yes |
| Portainer | Via K8s | Via K8s | N/A | Yes | Yes |
| EKS | Yes | Latest - 2 | Yes | Yes | Yes |
| GKE | Yes | Latest - 2 | Yes | Yes | Yes |
| AKS | Yes | Latest - 2 | Yes | Yes | Yes |
| Tanzu | Yes | Latest - 1 | Yes | Yes | Yes |
| MKE | Yes | Latest - 2 | Yes | Yes | Yes |
Multi-Cluster Support
| Tool | Multi-Cluster | Federation | Fleet Mgmt | Cross-Cluster Networking |
|---|---|---|---|---|
| Kubernetes | No (single) | Via KubeFed (deprecated) | No | Via Submariner, Cilium Mesh |
| K3s | No (single) | No | No | Via external tools |
| K0s | No (single) | No | No | Via external tools |
| MicroK8s | Limited (HA) | No | No | Via external tools |
| Docker Swarm | No (single) | No | No | No |
| Nomad | Yes (federation) | Yes (native) | Yes | Consul mesh gateway |
| Podman | N/A | N/A | N/A | N/A |
| OpenShift | Yes (ACM) | Yes (ACM) | Yes (ACM) | Submariner |
| Rancher | Yes (native) | No | Yes (Fleet) | Via external tools |
| Portainer | Yes (endpoints) | No | No | No |
| EKS | No (single) | No | Via AWS Org | VPC peering, Transit GW |
| GKE | Yes (GKE Fleet) | Yes (MCS) | Yes (Fleet) | Multi-cluster Services |
| AKS | No (single) | No | Via Azure Arc | VNET peering |
| Tanzu | Yes (TMC) | Yes (TMC) | Yes (TMC) | Tanzu Service Mesh |
| MKE | No (single) | No | No | No |
Best multi-cluster: Rancher (Fleet), OpenShift (ACM), Tanzu (TMC), GKE (Fleet), Nomad (federation)
Monitoring Integration
| Tool | Prometheus Metrics | Telegraf Plugin | Log Format | Fluent Bit | Grafana Dashboards |
|---|---|---|---|---|---|
| Kubernetes | Yes (native /metrics) | kubernetes input | JSON (structured) | Yes (kubernetes filter) | 100+ community dashboards |
| K3s | Yes (same as K8s) | kubernetes input | JSON | Yes (kubernetes filter) | Same as K8s |
| K0s | Yes (same as K8s) | kubernetes input | JSON | Yes (kubernetes filter) | Same as K8s |
| MicroK8s | Yes (same as K8s) | kubernetes input | JSON | Yes (kubernetes filter) | Same as K8s |
| Docker Swarm | Via cAdvisor | docker input | JSON (Docker logging) | Yes (Docker log driver) | Docker Swarm dashboards |
| Nomad | Yes (/v1/metrics) | exec plugin | JSON | Yes (file/syslog) | Community dashboards |
| Podman | No | exec plugin | JSON (journald) | Yes (systemd input) | Limited |
| OpenShift | Yes (built-in monitoring) | kubernetes input | JSON | Yes | OpenShift dashboards |
| Rancher | Yes (monitoring app) | kubernetes input | JSON | Yes (logging app) | Rancher monitoring dashboards |
| Portainer | Limited | exec plugin | JSON | Yes | Limited |
| EKS | Yes + CloudWatch | kubernetes input | JSON + CloudWatch | Yes + CloudWatch Logs | AWS dashboards + community |
| GKE | Yes + Cloud Monitoring | kubernetes input | JSON + Cloud Logging | Yes + Cloud Logging | GCP dashboards + community |
| AKS | Yes + Azure Monitor | kubernetes input | JSON + Azure Monitor | Yes + Azure Monitor Logs | Azure dashboards + community |
| Tanzu | Yes (TO + Wavefront) | kubernetes input | JSON | Yes | Wavefront dashboards |
| MKE | Yes | kubernetes input | JSON | Yes | Community dashboards |
Deployment and Licensing
| Tool | License | Self-Hosted | Language | Min RAM | Docker | Pricing Model |
|---|---|---|---|---|---|---|
| Kubernetes | Apache-2.0 | Yes | Go | 2 GB | N/A (is the orchestrator) | Free |
| K3s | Apache-2.0 | Yes | Go | 512 MB | N/A (is the orchestrator) | Free |
| K0s | Apache-2.0 | Yes | Go | 1 GB | N/A (is the orchestrator) | Free |
| MicroK8s | Apache-2.0 | Yes | Go/Snap | 540 MB | N/A (is the orchestrator) | Free |
| Docker Swarm | Apache-2.0 | Yes | Go | 512 MB | N/A (Docker built-in) | Free |
| Nomad | BSL 1.1 | Yes | Go | 256 MB | N/A (is the orchestrator) | Free (BSL); Enterprise paid |
| Podman | Apache-2.0 | Yes | Go | 256 MB | N/A | Free |
| OpenShift | Proprietary* | Yes | Go | 8 GB | No (CRI-O) | Per-core subscription; OKD free |
| Rancher | Apache-2.0 | Yes | Go | 4 GB | Yes | Free (SUSE support optional) |
| Portainer | Zlib | Yes | Go | 512 MB | Yes | CE free; Business $5/node/mo |
| EKS | Proprietary | No (managed) | – | – | – | $0.10/hr control plane + node costs |
| GKE | Proprietary | No (managed) | – | – | – | Free (Autopilot) or $0.10/hr + node costs |
| AKS | Proprietary | No (managed) | – | – | – | Free control plane + node costs |
| Tanzu | Proprietary | Yes | Go | 8 GB | No | Per-core subscription |
| MKE | Proprietary | Yes | Go | 4 GB | No | Per-node subscription |
* OpenShift is based on OKD (Apache-2.0) but the supported product requires a Red Hat subscription.
Lightest deployment: Nomad (256 MB), K3s (512 MB), Podman (256 MB, single-host only)
Heaviest deployment: OpenShift (8 GB+), Tanzu (8 GB+), full Kubernetes (2 GB+ per node)
Free options: All Apache-2.0 tools; AKS control plane (free); GKE Autopilot (free tier); Portainer CE; Nomad (BSL)
Tools
16 tools.
Amazon ECS
Amazon Elastic Container Service (ECS) is AWS’s proprietary container orchestration platform. Unlike EKS (which runs Kubernetes), ECS uses AWS-native task definitions and scheduling – there is no Kubernetes API or etcd involved.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Amazon EKS
Amazon Elastic Kubernetes Service (EKS) is AWS’s managed Kubernetes platform. AWS operates the Kubernetes control plane (API server, etcd, scheduler, controller manager) across multiple Availability Zones for high availability.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Azure AKS
Azure Kubernetes Service (AKS) is Microsoft Azure’s managed Kubernetes platform. AKS is notable for offering a free control plane – the Kubernetes API server, etcd, scheduler, and controller manager are managed by Azure at no cost.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Docker Swarm
Docker Swarm (Swarm Mode) is Docker’s native clustering and orchestration solution, built into the Docker Engine.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
Google GKE
Google Kubernetes Engine (GKE) is Google Cloud’s managed Kubernetes platform and the original managed K8s service (launched 2015).
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
K0s
K0s (pronounced “kay-zero-ess”) is a lightweight, CNCF-certified Kubernetes distribution created by Mirantis.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
K3s
K3s is a lightweight, CNCF-certified Kubernetes distribution created by Rancher Labs (now SUSE). It packages the entire Kubernetes control plane and worker components into a single binary of approximately 70 MB.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
Kubernetes
Kubernetes (K8s) is the industry-standard container orchestration platform, originally developed by Google and donated to the Cloud Native Computing Foundation (CNCF).
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
MicroK8s
MicroK8s is a lightweight, CNCF-certified Kubernetes distribution created by Canonical (the company behind Ubuntu).
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
Mirantis Kubernetes Engine
Mirantis Kubernetes Engine (MKE), formerly Docker Enterprise Edition (Docker EE), is an enterprise container platform that provides Kubernetes orchestration with a web-based management UI, integrated container registry, and enterprise secur…
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Nomad
Nomad is a flexible workload orchestrator from HashiCorp that schedules and manages containers, VMs, binaries, and batch jobs across a cluster.
License: MPL-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
OpenShift
Red Hat OpenShift Container Platform (OCP) is an enterprise Kubernetes distribution that adds developer experience, operational automation, and security hardening on top of upstream Kubernetes.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Podman
Podman (Pod Manager) is a daemonless, rootless container engine developed by Red Hat. Unlike Docker, Podman does not require a long-running daemon – each container runs as a direct child process of the Podman command.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
Portainer
Portainer is a lightweight container management UI that simplifies the operation of Docker, Docker Swarm, and Kubernetes environments.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Rancher
Rancher is an open-source multi-cluster Kubernetes management platform developed by Rancher Labs (acquired by SUSE in 2020).
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
VMware Tanzu
VMware Tanzu is a family of Kubernetes products from VMware (acquired by Broadcom in 2023) that brings Kubernetes to vSphere environments.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
