## 4 Microservice-Based Architecture  
This section presents the details of the proposed architecture for deploying and managing various digital forensics applications. Virtualization and containerization are two leading technologies for delivering modern cloud services. Both provide many automated functionalities to support every stage of the lifecycle of end-to-end services, including instantiation, update, and termination. However, there are important differences between these technologies that make them more appropriate for specific types of applications. VMs require more computing resources (CPU and memory) because they run on their operating system, and their startup time is long. In parallel, VMs provide full isolation. On the contrary, containers are lightweight because they share the host operating system, and their instantiation time is short. Moreover, the isolation of the containerized application is at the process level. According to the features above, VMs are more suitable for static cloud applications, while containers are appropriate for dynamic and IoT applications. To this end, we select Kubernetes, the most popular framework for cloud and IoT applications, as the resource orchestration platform due to its built-in capabilities on automating deployment and resource management for containerized applications. In the K8s platform, complex applications are broken down into microservices, which perform a specific task. This improves the resource management of every service based on performance and security requirements. The basic components of K8s ecosystem that are included in the proposed architecture are defined below:* **Pod**: The elementary functional unit including one or more containers and their shared volumes. * **Service**: Abstracts a set of pods that are components of an application. * **Node**: A (virtual or physical) computing machine, where pods are deployed. It is part of a cluster. * **Cluster**: A superset of nodes, which can be easily added or removed based on the workload demands. * **Deployment**: The process that manages the resources of the pods dedicated to an application. The Deployment Descriptor includes all parameters for creating or modifying instances of the pods that hold containerized applications. * **Kubernetes API server**: Exposes a RESTful interface to all Kubernetes resources, serves as the frontend of the Kubernetes control plane, and communicates with the Application Programming Interfaces (APIs) of Kubernetes to perform all the core functionalities. * **Ingress Controller**: An API object that provides external access to the services in a cluster, typically through HTTP requests. Ingress controller can provide load balancing, SSL termination, and name-based virtual hosting functionalities. * **Volume**: A directory accessible to all containers running in a pod. In contrast to the container-local filesystem, the data in volumes are preserved across container restarts and can be transferred in case of migration. K8s assigns to every pod a unique IP address and a single DNS name for a set of pods of an application, which is useful for applying load balancing techniques among them. Following the network slicing rationale, K8s uses services as an abstract way to create and connect the individual components of an application running on its cluster. Figure 2 illustrates the nested application deployment in a K8s cluster using the abstractive method of the K8s service. The pod's resources and the attributes of the mechanisms (autoscalers, ingress controllers) in K8s are declared in the Deployment Descriptors. These descriptors are submitted to the Kubernetes API server for the configuration of pods, services, and other K8s functional components. The Deployment Descriptors are either YAML or JSON objects that describe the resources, which we aim to use or customize along with the functionalities of K8s objects, to fit the needs of a digital forensics platform.