Self-Paced Training (3)-Docker Operations

Agenda
Troubleshooting Containers
Overview of Security practices
Private Registry
Intro to Docker Machine
Intro to Docker Swarm
Intro to Docker Compose
Building Micro Service Applications with Docker

Container Logging
View the output of the containers PID 1 process:docker logs <container name>
View and follow the Output:docker logs-f <container name>
Limit the Output:docker logs-f-tail 5 <container name>

Container Application Logs
Typically, apps has a well defined log location
Map a host folder to the application ' s Application log folder in the container
In this is the can view the log generated in the container from your Host folder
Run a container using nginx image and mount a volume to map The/nginxlogs folder in the host to The/var/log/nginx folder In the Container:docker run-d-p-v/nginxlogs:/var/log/nginx nginx

Check Container Logs
Run a new container using the Tomcat Image:docker run-d-p Tomcat
View the container log:docker logs <container id>
On your host machine, create a Folder/container/logs/nginx
Run a new container using the NGINX image and Mount The/container/logs/nginx folder Into/var/log/nginx:docker run-d-P -v/container/logs/nginx:/var/log/nginx Nginx
Look inside Your/container/logs/nginx folder and notice the new log files from the container

Inspecting a container
Docker Inspect command displays all the details about a container
Outputs details in JSON array
Use grep-to-find a specific property
Display all details of the specified Container:docker inspect <container name>
Display the IP address of the specified Container:docker inspect <container name> | grep IPAddress
Format:docker Inspect-format [{. Networksettings.ipaddress}] <container name>

Starting and stoping Decker daemon
If you started Docker as a service, use service command to stop, start and restart the Docker daemon
sudo service docker stop
sudo service docker start
sudo service docker restart
If not running as a service, run Docker executable in daemon mode to start the Daemon:sudo docker-d &
If not running as a service, send a SIGTERM to the Docker process to stop it
Run ' pidof Docker ' to find the Docker process PID
sudo kill $ (PID of Docker)

Docker Daemon Upstart configuration file
Located In/etc/default/docker
Use Docker_opts to control the startup options for the daemon when running as a service
Restart the service for changes to take Effect:sudo service Docker Restart
Start daemon with log level of debug and allow connections to a insecure registry at the domain of My_server.org:DOCKER _opts= "-log-level debug-insecure-registry my_server.org:5000"

Docker Daemon Logging
Start the Docker daemon with-log-level parameter and specify the logging level
Levels is (in order from the most verbose to least):
Debug
Info
Warn
Error
Fatal
Run Docker daemon with debug log level (log written on terminal): sudo docker-d-log-level=debug
Configuring in Docker_ops (log output would be written to/var/log/upstart/docker.log): docker_opts= "-log-level Debug"

Linux Containers and security
Docker helps make applications safer as it provides a reduced set of default privileges and capabilities
namespaces provide an isolated view of the system. Each container have its own
IPC, network stack, root file system etc ...
Processes running in one container cannot see and effect Processes in another container
Control groups (Cgroups) isolate Resource usage per container
Ensures a compromised container won ' t bring down the entire host by exhausting resources

Quick Security Considerations
Docker Daemon needs to run as root
Only ensure that trusted users can control the Docker daemon
Watch who I add to Docker group
If binding the daemon to a TCP socket, secure it with TLS
Use Linux Hardening Solution
Apparmor
SELinux
Grsec

Private Registry
Allows you to run your own registry instead of using Docker Hub
Multiple options
Run Registry Server using container
Docker Hub Enterprise
Versions:
Registry v1.0 for Docker 1.5 and below
Registry v2.0 for Docker 1.6

Setting up a private registry
Run the registry server inside a container
Use the registry image at Https://registry.hub.docker.com/u/library/registry
Image contains a preconfigured version of Registry v2.0
Run a new container using the registry Image:docker run-d-P 5000:5000 registry:2.0

Push and pull from private registry
First tag the image with host IP or domain of the registry server and then run Docker push
Tag image and specify the registry host:docker tag <image id> my_server.net:5000/my-app:1.0
Push image to Registry:docker push my_server.net:5000/my-app:1.0
Pull image from Registry:docker pull my_server.net:5000/my-app:1.0
List tags:curl-v-X GET http://localhost:5000/v2/mynginx/tags/list

Docker Machine Overview
Docker Machine was a tool that automatically provisions Docker hosts and installs the Docker Engine on them
Create additional hosts on your own computer
Create hosts on cloud providers (e.g. Amazon AWS, Digitalocean etc ...)
Machine creates the server, installs Docker and configures the Docker client

Installing machine
Download the binary for the operating system at https://github.com/docker/machine/releases/tag/v0.2.0
Place the binary into a folder of your choice
Add the folder to your system environment PATH

Creating a host
Use ' docker-machine create ' command and specify the driver to use
Use virtual box driver if creating hosts on a Windows or Mac
Need to the Virtual Box installed (https://www.virtualbox.org/)
Create a host named "Testiest" on the current machine, using virtual box:docker-machine create-driver virtual Box Testho St

Provisioning hosts in the cloud
Each cloud provider have different options on the docker-machine create command
See https://docs.docker.com/machine/#drivers as reference
Example with Digitalocean
Docker-machine create-driver digitalocean-digitalocean-access-token <your access Token>-digitalocean-size 2GB Testhost
List Machines:docker-machine ls

Docker Machine SSH
Allows us to connect to a provisioned host using SSH
Logs in using the SSH key, created when creating
Connect to Host3 using Ssh:docker-machine SSH host3

What's Docker Swarm
Docker Swarm is a tool that clusters Docker hosts and schedules containers
Turns a pool of host machines into a single virtual host
Ships with simple scheduling backend
Supports Many discovery Backends
Hosted Discovery
Etcd
Consul
ZooKeeper
Static files
Https://docs.docker.com/swarm/discovery

Setup process (using hosted discovery)
On the machine so you'll use as the Swarm master, run a command to create the cluster
Start Swarm Master
For each node with Docker installed, run a command to start the Swarm agent
Note:agents can started before or after the master

Installing and Running Swarm
Most convenient option was to use the Swarm image on Docker Hub https://registry.hub.docker.com/u/library/swarm/
Swarm container is a convenient packaging mechanism for the Swarm binary
Swarm containers can run from the image to do the following
Create a cluster
Start the Swarm Manager
Join nodes to the cluster
List nodes on a cluster

Create the Swarm cluster
' Swarm create ' command would output the cluster token
Token is a alphanumeric sequence of characters that identifies the cluster when using the hosted Discovery Protocol
Copy this number somewhere

Run a container using the swarm image. We run the Create command of the Swarm application inside and get the output on our terminal. -rm means to remove the container once it has finished running.
Docker RUN-RM Swarm Create

Start the Swarm Manager
Run a container that run the ' Swarm manager '
Make sure to map the swarm port in the container to a port on the Host:docker run-d-P Swarm manage token://<cluster Token>

Connect a node to the cluster
Run a container that funs the ' swarm join ' command
Specify the IP address of the node and the port the Docker daemon is listening on
Note:your Docker daemon On the machine must is configured to listen on a TCP port instead of just on the UNIX socket.
Docker run-d swarm join-addr=<node ip>:<daemon port> token://<cluster token>

sudo service docker stop
sudo vim/etc/default/docker
sudo service docker start

docker_host=localhost:2375
Export Docker_host

Connect the Docker client to Swarm
Point your Docker client to the Swarm manager container
Methods:
Configuring the Docker_host variable with the Swarm IP and port
Run Docker with-h and specify the Swarm IP and port
Look at the container port mapping to find the Swarm port

Configure the Docker_host variable
Export Docker_host=127.0.0.1:<swarm port>
Run Docker client and specify the daemon to connect to
Docker-h Tcp://127.0.0.1:<swarm port>

Checking Your connected nodes
Run ' Docker info '
Since client is connected to Swarm, it'll show the nodes

Run a container in the cluster
Standard ' Docker run ' command
Swarm master decides which node to run the container on based on your scheduling strategy
Https://docs.docker.com/swarm/scheduler/strategy
Running ' Docker ps ' would sow which node a container is on

What is Compose
Docker Compose is a tool for creating and managing multi container Applications
Containers is all defined in a single file called ' docker-compose.ml '
Each container runs a particular component/service of your application.
For example:
Web Front End
User Authentication
Payments
Database
Container links is defined
Compose'll spin up all your containers in a single command

Configuring the Compose yml file
Defines the services that make up your application
Each service contains instructions for building and running a container
Example
Javaclient:
Build:. (Building using Dockerfile in current directory)
Command:java HelloWorld
Links
-redis
Redis
Image:redis (Use the latest Redis Image from Docker Hub)

Build and image Instruction
' Build ' defines the path to Dockerfile, that'll be used to build the image
Container'll be run using the image build
' Image ' defines the image that would be used to run the container
All services must has either a build or image instruction

Running your application
Use ' Docker-compose up '
Up command would
Build the image for each service
Create and start the containers

Install Docker-compose
https://docs.docker.com/compose/install/
Curl-l https://github.com/docker/compose/releases/download/1.2.0/docker-compose-uname-s-uname-m >/usr/local/ Bin/docker-compose
sudo chmod +x/usr/local/bin/docker-compose

Self-Paced Training (3)-Docker Operations