Comparison
Configuration managementvsImage baking
Configuration management
an agent installs the packages, writes the files and restarts the service on machines that already exist, over and over.
Bringing the inside of an already-running machine to a desired state — packages, files, users, services — repeatedly. It was the dominant discipline when servers were long-lived, and immutable infrastructure has taken most of its work away by rebuilding the image instead. It remains genuinely necessary wherever machines are long-lived and cannot simply be replaced, which is most estates that predate containers.
Full entry →Image baking
a scheduled job boots a base machine, applies the configuration, snapshots it and publishes a new version every week.
The pipeline that produces golden images: start from a base, run configuration management once, test it, snapshot it, promote it. It is where configuration management survives in an immutable world — run once at build time instead of forever at run time. The cadence is the whole point, since the security value of a golden image comes from being rebuilt, not from being golden.
Full entry →