Docker

From Leo's Notes
Revision as of 00:32, 7 October 2017 by Leo (talk | contribs) (introduction)
This page was last edited on 7 October 2017, at 00:32.

Docker is a tool that allows applications inside sandboxed system environments called containers. It allows the user to reliably build a system environment including all required dependencies for an application. Docker provides containers with additional services such as network access, volume management, and resource limits. Unlike a traditional virtual machine, applications running on Docker will have a lighter footprint since applications run natively on the host's kernel.

Installation

Install docker using your package manager and then start the service.

On a Fedora distro (https://docs.docker.com/engine/installation/linux/docker-ce/fedora/#install-using-the-repository): 

# dnf config-manager --add-repo  https://download.docker.com/linux/fedora/docker-ce.repo
# dnf install docker-ce
# systemctl start docker

If installed properly, the docker hello-world command should work without issue. 

# docker run hello-world

To play with docker, you will need to run things as root or be part of a group that has access to docker's socket.

See more here: https://docs.docker.com/engine/installation/linux/linux-postinstall/

Introduction

Images

An image contains all the necessary files to start an application. This includes all libraries, system files, and configuration files. An image should only contain just enough files to get the application working. 

# docker images


Containers

A container is a running instance of an image.

Usage Reference

Command Description
docker images Lists docker images that you created or pulled using docker pull
docker pull Pulls a docker image from a registry (can be from docker.io or a private registry)
  • Version numbers can be given after a colon.
docker run Runs a command in a container. Eg. docker run alpine ls -l
  • For commands that require an interactive shell, pass in -it.
  • Pass in --name for a custom name instead of a long hash
  • Pass environment vars using -e
  • Pass -d to detach immediately
  • Pass -P to specify the image
docker ps Lists containers that are running.

Pass -a to see all containers that executed.

docker port shows the port mapping between the container and the host.
docker stop Stop a container
docker kill ??
docker rm Removes a container. Use -rf to stop and remove.

Creating an Image

To create an image:

  • Create a directory containing any custom files
  • Create a Dockerfile in the directory.
  • Run docker build to build the image

Dockerfile

The docker file should a the minimum contain: 

# The base image to use
FROM baseimage:version

# What to run when the image is started. This can contain any number of RUN or COPY commands
RUN yum install any-dependencies

# Expose any ports that are required
EXPOSE 80

# run the application
CMD ["python", "/some/app.py"]

Deploying an Application

Use Docker Swarm mode to deploy an application that relies on multiple services where each is a separate docker instance.

The swarm file lets you define each server that is part of the application.

See more at https://github.com/docker/labs/blob/master/beginner/chapters/votingapp.md

Questions

  • How are updates to the base image done? Does it automatically update containers relying on it? Or will containers need to be rebuilt again?
    • Images are supposed to be immutable. When launching the image, any data that needs to be persistent must be externally provided with -v outside/path:inside/path. When the base image is updated (say, CentOS 7.2 to CentOS 7.3), all images relying on it will need to be rebuilt from the Dockerfile. The resulting image is then used to 'relaunch' the container.
  • How is data kept persistent? Does it need to be copied out/in every time it is to be rebuilt?
    • Persistent data should be saved outside of the container using the -v outside/path:inside/path.
  • NFS access from the container?
    • You can mount a NFS share. But anything that requires a domain trust (like domained accounts) might not be feasible.
  • Domain trust - is it the same as a regular VM?
    • May not be feasible without hard coding some credentials in the dockerfile. Application based LDAP lookups with a binding account should still work.

Could it be used for...

  • dictd (probably easily)
  • WebCat (swarm tomcat + MySQL?)
  • ftp (Requires NFS)
  • compute balancer
  • firewall manager (swarm apache + MySQL)

See Also