Docker

Image : package has everything needed to run an application, includes

• code,runtime,libraries,environment variables,configuration files,entry points
• "docker image inspect" examine the details of an image

Container : runtime instance of an image, inside a machine running docker or a Node in a swarm

Service : above Container, define how containers behave in a production

Swarm: a group of Nodes as a cluster

Stack : above Service, defines interaction of all services

Is built upon a stack of layers, each represents an instruction in the image's Dockerfile (each command adds a layer).

Each, unless the last one, is read only.

• A container and an image differs in the top writable layer. Container has a top writable layer for all added/changed files. Underlying image remains unchanged.

Dockerfile defines what goes into the container:

• networking
• files

Build an Image

1. Create a folder
2. Create a Dockerfile
   • FROM xxxxx
     • Use a parent image
   • WORKDIR /path/to/work/dir
     • this dir will be created and as the current path when launch
   • ADD host-path /path/in/container
   • RUN something in container to prepare the image
   • EXPOSE 80
     • make port available to outside world
   • ENV NAME Value
     • make environment variable NAME=Value
   • CMD ["command", "parameter"]
     • Run something when container launches
3. Build the image
   • $docker build -t tag path
• Tips
  • See https://runnable.com/blog/9-common-dockerfile-mistakes
  • Be smart, use docker cache to save build time
  • Or, separate into multiple images and assemble at the end https://dille.name/blog/2018/08/19/how-to-reduce-the-build-time-of-a-monolithic-docker-image/

Push image onto registry (see Registry)

• Container size: "docker ps -a", size is the writable layer size. virtual size is everything, but the read-only parts are shared.
• Container Inspect
  • docker ps : list containers
  • docker inspect [container_id] : technical details
  • docker exec -it [container_id] bash : access to shell
• Launch a Container
  • $docker run [-it] [image] [command]
    • command is optional because image builder may have specified entry points
• To provide container GUI:
  • http://wiki.ros.org/docker/Tutorials/GUI
    • this method mounts X server socket, may be more secure but found mounting can fail on my Dell ubuntu 18.10
  • https://medium.com/@SaravSun/running-gui-applications-inside-docker-containers-83d65c0db110
    • seems like this method allows container access host X through network and .Xauthority
  • https://github.com/mviereck/x11docker very complicated script for securing and launching docker container with GUI

• Service is "Containers in production" (not just a single lonely Container)
• Needs to install "docker-compose"
• Service is part of a distributed application
• Defined by docker-compose.yml
  • (the just one) image to run
  • ports to use
  • number of replicas
  • resources each replica can use
    • CPU
    • memory
  • restart policy
  • network
• To run a service
  • $docker swarm init (see swarm)
  • $docker stack deploy -c docker-compose.yml name-of-stack
    • deploy, or if already deployed, update the stack
    • so if number of replica changes, does not kill all then redeploy, but just launch / kill to meet the target
• To update service
  • Just build updated image and push to repository
  • run $docker deploy again to update the service
• Inspect service
  • $docker service ls
  • $docker service ps name-of-stack
  • $docker container ls [-q]
    • this lists all containers (running images) but does not filter by service
• Take down the service
  • docker stack rm name-of-stack
  • docker swarm leave [--force]

• Swarm
• Container is running instance of image
• Container run in machine, virtual or real (running Docker of course)
  • the machine (Docker) run in single-host mode, or can be switched to swarm mode
• Swarm is group of the machines (now Nodes) joined into a cluster
• Commands are executed to a Swarm by a swarm manager
  • swarm manager is the only machine in the swarm that can execute commands
  • and can authorize other machines to join the swarm as workers
• Strategies
  • "emptiest node" - fill least utilized
  • "global" - every machine get exactly one instance of the container
• Setup swarm
  • To test, use "docker-machine create" to create virtual machines
    • $docker-machine ls
    • $docker-machine ssh
    • docker vm does not persist volume
  • $docker swarm init - init swarm & make this machine a swarm manager
  • $docker swarm join - on worker machine, to join as worker
• Inspect
  • $docker node ls (on the manager)
• Use a swarm
  • "docker-machine ssh" and just do everything on manager, docker login, docker stack deploy...
    • $docker-machine ssh myvm1 "docker container ls -q"
  • "docker-machine env", run the command to setup environment, "docker-machine ls" to make sure the manager is active, then
    • docker commands now send to the manager, and you can work locally (no need to copy files to manager)
  • access the app from ANY address of the nodes work, serviced by ANY node.
    • the nodes in a swarm participate in an ingress routing mesh
    • all service ports in swarm must be reserved
    • port 7946 TCP/UDP & 4789 UDP to be open

• Stack
• Overview
  • Group of services that share dependencies & orchestrate, scale together
  • Single stack capable of entire application (if not overly complex)
• Define a stack
  • define multiple services in the docker-compose.yml
  • define resources (to share)
    • volumes (from host to container)
      • add placement constraint to lock in one host (single source of truth)
• Registry

• Registry has many Repositories, Repository has many Images, an Account on a Registry can create many Repositories
• docker CLI uses Docker public registry by default
• Docker Trusted Registry - enterprise private registry
• tag [image] [username/repository:tag]
  • optional but recommended, to associate a local image with a repository on a registry and give it a version
• push username/repository:tag
• then able to run from any docker "docker run username/repository:tag"