What is a Sidecar Container in Kubernetes? Explained Simply

apiVersion: v1
kind: Pod
metadata:
  name: my-app
spec:
  containers:
  - name: main-app          # Your application
    image: my-app:1.0.0
    ports:
    - containerPort: 8080
  
  - name: log-collector     # Sidecar
    image: fluent-bit:latest
    volumeMounts:
    - name: logs
      mountPath: /var/log/app
  
  volumes:
  - name: logs
    emptyDir: {}

containers:
- name: app
  image: my-app:latest
  # writes logs to /var/log/app/
 
- name: fluent-bit
  image: fluent/fluent-bit:latest
  # reads /var/log/app/, ships to Loki
  volumeMounts:
  - name: app-logs
    mountPath: /var/log/app
    readOnly: true

# Check injected sidecars in an Istio mesh
kubectl get pod my-app -o jsonpath='{.spec.containers[*].name}'
# Output: my-app istio-proxy   ← the sidecar was auto-injected

annotations:
  vault.hashicorp.com/agent-inject: "true"
  vault.hashicorp.com/agent-inject-secret-db-password: "secret/data/db"
  vault.hashicorp.com/role: "my-app"
 
# Vault agent sidecar writes /vault/secrets/db-password
# Main app reads from that file — never touches Vault API directly

- name: git-sync
  image: registry.k8s.io/git-sync/git-sync:v4.2.1
  args:
  - --repo=https://github.com/org/config-repo
  - --branch=main
  - --period=60s
  - --root=/git
  volumeMounts:
  - name: config
    mountPath: /git

spec:
  initContainers:
  - name: wait-for-db        # runs first, exits when done
    image: busybox
    command: ['sh', '-c', 'until nc -z db 5432; do sleep 2; done']
  
  containers:
  - name: app                # starts after init container exits
    image: my-app:latest
  - name: log-collector      # starts at same time as app, runs alongside it
    image: fluent-bit:latest

initContainers:
- name: log-collector
  image: fluent-bit:latest
  restartPolicy: Always    # ← this makes it a native sidecar