Docker in practice

Docker / AuFS / cgroups presentation

[ 0 - Docker daemon ]
[ 1 - Docker version ]
[ 2 - Docker remote API ]
[ 3 - Docker registry/hub ]
[ 4 - Docker layers ]
[ 5 - Linux AuFS ]
[ 6 - Docker build ]
[ 7 - Docker run - auto delete ]
[ 8 - Docker run - background mode ]
[ 9 - Docker compose ]
[ 10 - Docker debugging ]
[ 11 - cgroups ]
[ 12 - Docker security ]

Transcript

1. DevOps Brisbane 7 July 2016 Cluster management with Docker Kubernetes, Mesosphere, ECS & Docker Swarm
2. in practice
3. Architecture
4. Image ↔ container Images ~ classes Layers ~ inheritance Containers ~ instances OOP analogy
5. Docker daemon Remote API Architecture client / server service docker [start/stop/status] docker version docker -H=tcp://external-docker-daemon
6. Public - hub.docker.com Private registry: private images / mirroring Registry images repository docker search [image] docker pull [image] docker login [registry-url]
7. Registry docker hub
8. Images apps/desktop/API/system libs/languages/DB
9. 1 namespace, N versions (tags) Layers cache mechanism Image download docker pull [image][:tag] docker images
10. ~ read-only base layers ~ read-write container layer Image inspect docker history [image] docker save [image] > image.tar
11. Image union-capable FS 1 image = 1 tar See • Docker storage driver • UnionFS, aufs, overlay
12. Image build - Dockerfile FROM my-registry:5000/node RUN apt-get install -y ruby RUN gem install sass RUN mkdir /src RUN npm install gulp -g WORKDIR /src ADD app/package.json /src/package.json RUN npm install EXPOSE 3000 CMD ["npm", "start"] Docker file / instructions 1 line = 1 layer Inheritance between images
13. Repeatable environment Commits preserve consistency Image build docker build -f Dockerfile -t my/image:1.0 docker [commit/push] [image][:tag]
14. ~ process running in a read-write copy of a thin FS share the kernel of host system Isolation of the outside world via namespaces Container run docker run --name my-app [image] (command) docker ps /proc/[pid]/ns, ps aux, hostname, /proc/mounts
15. connect by names network ports mapping Multi-containers links docker run --name db mongo docker run --link db:db -p 80:80 [node-app]
16. docker-compose.yml Multi-container environment Multi-containers docker-compose docker-compose [up/stop/..] web:
 build: ./app
 volumes:
 - "./app:/src/app"
 ports:
 - "3030:3000"
 links:
 - "db:redis"
 command: node /src/app/index.js 
 db:
 image: redis

17. Container debugging docker exec -it [container] /bin/bash docker logs [container] docker events docker daemon -D / /var/log/docker.log
18. Control memory, CPU, I/O (disk, network) Isolate / Dedicate resources See: cgroups vs. OOM-killer Container resources management docker top [container] docker stats docker update --memory 300M [container]
19. Persistent storage Volumes bypasses ephemeral layers (AuFS) volumes Container
20. Bind-mounting volumes Shared-volumes volumes docker run -v [host-path]:[container-path]: [ro] [image] docker inspect --format="{{json .Volumes}}" my_container docker volume inspect [volume-id] Container
21. Bind-mounting volumes Shared-volumes Container volumes - backup docker run —volumes-from=[container] [image] tar cvf - /var/lib/mysql | gzip > mysql-data.tar.gz
22. Container freeze Container live migration See: cgroup freezer Container lifecycle docker (un)pause [container] docker (un)load [container]
23. Restart policies POSIX signals Attach / detach Container lifecycle docker [kill/rm/start/stop] [container] docker run --restart=always [image] docker run —detach [image]
24. Container security Security profiles (labeling systems) Docker-bench- security tool USER instruction Linux capabilities
25. Container security
26. Docker pre-installed Multi-host environment Development docker-machine docker-machine [create/stop/..]
27. Easy upgrades / codebase migrations Sane local tests ‘Faster’BDD / unit tests CI/tests quality docker run [options] node:6.0.0 npm test docker run [options] node:5.0.0 npm test It works ̶o̶n̶ ̶m̶ y̶ ̶m̶ a̶c̶h̶ i ̶n̶e̶
28. CI/tests matrice testing
29. Deployment configuration Environment vars Dev / prod parity docker run [options] —env-file app.env my-app NODE_ENVIRONMENT=production MYAPP_DB_URI=mongodb://db/app-dev MYAPP_PORT=3000 TRANSLINK_API=https://api.translink.com.au/v2
30. automated build web hooks Deployment authentication Cloud friendly: heroku, codefresh, .. automation
31. Nodes/agents deployment GoCD / Jenkins / … Dynamic load-balancing Træfɪk / HAProxy / … Distributed apps service discovery
32. Automatic “desired state” Self-healing infrastructure High-availability cluster management
33. Docker Docker is for Ops only, Dev only My [project/team] is too [big/small] My apps are already bundled as RPM/DPKG packages Docker replaces CM tools Docker [inside/vs] VMs misconceptions / (false?) debates
34. Docker benefits Faster developer onboarding Increase release frequency Facilitates refactoring / testing Images inheritance Evolutive / scalable infrastructures High-density servers Immutable deploys
35. @garciarwilliam wgarcia@thoughtworks.com
36. Logos Credits • Docker official logos / schemas • techfree.com.br/wp-content/uploads/ 2015/10/0812.sdt-docker.png • https://www.howtoforge.com/images/docker-how- to-use-it-in-a-practical-way-part-3/big/pic_7.jpg