Docker Deep Dive

---

About Me

DevOps@RajeshKumar.XYZ

What We’ll Learn

• Linux Containers
  • Containers vs Virtual Machines << FIGHT!!
  • Kernel namespaces, cgroups, Capabilities…
• Docker Engine
  • Execution Driver: libcontainer vs LXC
  • AUFS, OverlayFS, Device Mapper…
• Docker Images
  • docker build | docker images | docker inspect…
  • Union mounts, Layering, Dockerfile
• Docker Containers
  • docker start | stop | restart
• Registries, Volumes, Networking….

Prerequisites

Introducing Containers

---

It’s all about applications

server : application:

1 : 1

Containers are more lightweight than Virtual Machines

The Evolving Docker Platform

The Future of Docker

Chip-level assists for Containers

• Performance offloads
• Security features
• ......

Coming up Next….

• Installing Ubuntu and CentOS Linux
• Installing and updating the Docker Daemon

Installing Ubuntu Linux and CentOS Linux

---

Installing and Updating Docker

---

Module Recap

Major Docker Components

---

Module Outline

• Docker Engine
• Images
• Containers
• Registries and Repositories

Major Docker Components

The Big Picture

Containers can contain malicious code

Trust the code you run!

Registries and Repositories

A Quick Look

Module Recap

A Closer Look at Images and Containers

---

A Closer Look at Images and Containers

The Good Stuff!

Focusing in on Containers

More Good Stuff…

One Process per Container…

Usually…

Module Recap

Container Management

---

Module Outline

• Container Management
• Container Config
• Look Inside Running Containers
• Different Ways to Get Shell Access

“One process per Container”

We can run multiple processes per Container

“One process per Container”

• One concern per container
• Lean
• Simple!

We can run multiple processes per Container

docker attach

• Attaches to PID 1 inside the container
• In the real world, PID 1 inside a container will probably not be a shell

ssh

• Most containers won’t be running an SSH server

nsenter

• Allows us to enter Namespaces
• Requires the containers PID (get from “docker inspect”)

Module Recap

Building from a Dockerfile

---

Module Outline

• The Big Picture
• Dockerfile Basics
• Creating a Dockerfile
• Building from a Dockerfile

• Dockerfile
• Plain-text
• Simple format
• Instructions to build image

Module Recap

Diving Deeper with Dockerfile

---

Module Outline

• The Build Cache
• Dockerfile and Layers
• Dockerfile Instructions
  • CMD, ENTRYPOINT, ENV, VOLUME

• Dockerfile
• Plain-text
• Simple format
• Instructions to build image

 
	CMD                                              RUN
	Run-time                                         Build-time
	Run commands in
	containers at launch time                        Add layers to images
	                                                 Used to install apps
	Equivalent of -
	    docker run < args > <command></command>
	    docker run < args > /bin/bash
	One per Dockerfile
	
	
	                        

 
    Shell Form                                     Exec Form
    Commands are expressed the same                JSON array style -
    way as shell commands                            [“command”,“arg1”]
    Commands get prepended                         Containers don’t need a shell
    by “/bin/sh –c”                                Avoids string munging by the shell
    Variable expansion etc…                        No shell features –
	                                               No variable expansion
                                                        No special characters (&&,||,>….)

	                        

ENTRYPOINT

• Can’t be overridden at run-time with normal commands – docker run …< command >
• Any command at run-time is used as an argument to ENTRYPOINT
• Variable expansion etc…

Module Recap

Docker Networking

---

Module Outline

• The “docker0” Virtual Bridge
• Virtual Ethernet Interfaces
• Exposing Ports
• Linking Containers

Module Recap

Troubleshooting

---

What We’ll Learn

• Docker Daemon Logging
• Container Logging
• Troubleshooting Images
• Network Troubleshooting

Docker Daemon Logging

Container Logging

Replay

Use volumes to share and
persist data

Image Troubleshooting

Test Before Dockerfile

         FROM ubuntu:15.04

 
					FROM ubuntu:15.04
						
					
					
					CMD ping 8.8.8.8

 
					FROM ubuntu:15.04
					
					
					RUN apt-get install–y
					iputils-ping
							
					CMD ping 8.8.8.8

 
					FROM ubuntu:15.04
					
					RUN apt-get update
					
					RUN apt-get install–y
					iputils-ping
						
					CMD ping 8.8.8.8

 
					FROM ubuntu:15.04
					
					RUN apt-get update &&\
					  apt-get install –y \
					  iputils-ping
						
					CMD ping 8.8.8.8

Image Troubleshooting

Intermediate Images

Network Troubleshooting

docker0

Network Troubleshooting

IPTables

- - icc =

- - iptables =

*Both default to true

Module Recap

Lightning Fast Recap

Next Steps

This isn’t the end.

It’s…. just the beginning!

Questions?

Thanks for You

---