Containers are only one layer
OCI images are portable artifacts, and Kubernetes provides a common workload API. The running system still depends on storage classes, ingress controllers, identities, load balancers, DNS, secrets, managed databases and provider-specific controllers.
A useful migration tool must show those dependencies instead of declaring success after a Deployment object applies.
The migration needs a durable system model
Discovery should produce a versioned description of workloads and their relationships without collecting secret values. That model becomes the binding between source evidence, approved transformations and target verification.
- Workloads, services, routes and scheduled jobs
- Digest-pinned images and supply-chain policy
- Secret and configuration references without values
- PVCs, access modes, capacities and consumers
- Cloud services, identities, DNS and network dependencies
- Acceptance checks, rollback boundary, RPO and RTO
Persistent data determines the real portability boundary
Provider-native disk snapshots are useful but are not automatically portable across clouds. A cross-provider path normally needs filesystem-level movement through durable object storage, CSI snapshot data movement, or an application-native backup and restore.
Write-sensitive systems need a consistency decision. A database may require a native dump, checkpoint, replication or explicit quiesce rather than a live filesystem copy. Restore integrity and application invariants must be measured before cutover.
Where AnchorScape is today
AnchorScape’s migration work now covers external Kubernetes discovery, portable system releases, target preflight, reviewed server-side dry runs, digest-preserving image adoption, supply-chain evidence, destination configuration readiness and provider-neutral Velero/Kopia data-mobility assessment.
That is meaningful groundwork, not a claim that one-click production migration is finished. Backup/restore execution, landing-zone provisioning, workload rehearsal, traffic cutover and rollback still require controlled implementation and real source-to-target proofs. Access is therefore handled through the private pilot.