Showing posts with label Docker. Show all posts
Showing posts with label Docker. Show all posts

03 May 2019

Multi-stage build in Docker

Multi-stage build allows multiple FROM statements in a Dockerfile. The instructions follows each FROM statement until the next one & creates an intermediate image. The final FROM statement is the final base image.
Artifacts from intermediate stages can be copied using COPY --from='#/stageName' starting from 0 for the first base image. The artifacts not copied over are discarded. This allows to keep the final image light and only include the relevant artifacts.

FROM syntax is updated to specify stage name using 'as' 

FROM maven:3.5-jdk-8 as build

This allows to use the stage name instead of the number with --from option

lets take a look on a sample Dockerfile:
---
FROM maven:3.5-jdk-8 as build
COPY src /usr/src/myapp/src
COPY pom.xml /usr/src/myapp
RUN mvn -f /usr/src/myapp/pom.xml clean package
FROM jboss/wildfly:10.1.0 Final
COPY --from=BUILD /usr/src/myapp/target/people-1.0-SNAPSHOT.war /opt/jboss/wildfly/standalone/deployments/people.war
---

In this Dockerfile:

There are two FROM instructions. This means it is a two-stage build.
maven:3.5-jdk-8 is the base image for the first build. This is used to build the WAR file for the application. The first stage is named as BUILD.
jboss/wildfly:10.1.0.Final is the second and the final base image for the build. WAR file generated in the first stage is copied over to this stage using COPY --from syntax. The file is directly copied in the WildFly deployments directory.

Br
Punit


21 January 2019

what is docker-compose

When you wish to run services together and want to run them as single unit then docker-compose is the tool for you, which allows you to run multiple services as kind of micro service by defining them in a single configuration file.
  • docker compose is a docker tool for defining and running multi containers docker application.
  • docker compose allows us to define all the services in a configuration file and with one command it will spin up all the containers that we need.
  • it uses yaml files to configure application services (docker-compose.yml)
  • it uses single command to start and stop all the services (docker-compose up & docker-compose down)
  • it can scale up services when ever required.
by default this tool is automatically installed when you are on windows or mac with docker v1.12+

but if you are on Linux try this command given at github for docker-compose
$ curl -L https://github.com/docker/compose/releases/download/1.23.2/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
$ chmod +x /usr/local/bin/docker-compose



alternatively you can find the latest version available here at github

docker-compose.yml prototype will look like:

version:
services:
  image:
network:
volume:


version: first thing first define version of the docker-compose that we are using, there is no restrictions of not to use latest version of compose so I have used '3' here

version: '3'

services: service definition contains configuration which will be applied to each container started for that service, much like passing command-line parameter to docker run
version: ‘3’
services:
webserver:
image: punitporwal07/apache
ports:
- “9090:80”
database:
image: mysql
ports:
- “4041:3306”
environment:
- MYSQL_ROOT_PASSWORD=password
- MYSQL_USER=user
- MYSQL_PASSWORD=password
- MYSQL_DATABASE=demodb

so instead of defining items in docker run command, now we can define it more easily in configuration file here but with little bit of syntax


now launch the service using a simple command docker-compose up and it will spin up mysql and apache in fractions of minutes for you.


Br,
Punit



20 January 2019

All about Docker swarm

There is always a requirement to run every individual service without a fail over and load balancing. When this comes to container services docker swarm comes into picture.
Docker swarm is a cluster of docker containers and provide a container orchestration framework.
  • comprises of managers and workers
  • managers are also know as workers
  • there will be only one manager as leader, other managers will act as a backup
  • as a pre-requisite, you docker version should be on 1.12+
To initiate docker swarm

$ docker swarm init --advertise-addr :2377 --listen-addr managerIP:swarmListenPort

2377: is the default port for swarm
addvertise-addrwill let swarm manager to use specific IP:PORT. here I am running this on ec2 instance as manager1(in case if your host contains multiple IPs its best practice to use a specific one for all swarm related stuff)

**
[root@ip-172-31-22-15 ec2-user]# docker swarm init --advertise-addr 172.31.22.15:2377 --listen-addr 172.31.22.15:2377
Swarm initialized: current node (icuih1r0n8juo8xigkceniu3j) is now a manager.

To add a worker to this swarm, run the following command:

    docker swarm join --token SWMTKN-1-15z6ejowow53p7cn1ncam9v4vz049jzgnoghpi7tr63dn550as-7998mw9s4djvozgde40xnh3ig 172.31.22.15:2377

To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.

[root@ip-172-31-22-15 ec2-user]# docker node ls
ID                           HOSTNAME  STATUS  AVAILABILITY  MANAGER STATUS
icuih1r0n8juo8xigkceniu3j *  docker    Ready   Active        Leader

**
the highlighted command is the exact command that we need to run on a worker/manager that you wanna join to this swarm, it includes a token

[root@ip-172-31-22-15 ec2-user]# docker swarm join-token manager
To add a manager to this swarm, run the following command:

    docker swarm join --token SWMTKN-1-15z6ejowow53p7cn1ncam9v4vz049jzgnoghpi7tr63dn550as-9wiyb3pyiviqikgid7wettiqs 172.31.22.15:2377


[root@ip-172-31-22-15 ec2-user]# docker swarm join-token worker
To add a worker to this swarm, run the following command:

    docker swarm join --token SWMTKN-1-15z6ejowow53p7cn1ncam9v4vz049jzgnoghpi7tr63dn550as-7998mw9s4djvozgde40xnh3ig 172.31.22.15:2377

following above command to join leader as worker/manager launch another ec2 instance or any with docker 1.12+ in it and

$ docker swarm join --token SWMTKN-1-15z6ejowow53p7cn1ncam9v4vz049jzgnoghpi7tr63dn550as-9wiyb3pyiviqikgid7wettiqs 172.31.22.15:2377

you will see all the workers/managers you have joined with your swarm from Leader node as:

[root@ip-172-31-22-15 ec2-user]# docker node ls
ID                           HOSTNAME  STATUS  AVAILABILITY  MANAGER STATUS
1ndqsslh7fpquc7fi35leig54    worker4   Ready   Active
1qh4aat24nts5izo3cgsboy77    worker5   Ready   Active
25nwmw5eg7a5ms4ch93aw0k03    worker3   Ready   Active
icuih1r0n8juo8xigkceniu3j *  manager1  Ready   Active        Leader
5pm9f2pzr8ndijqkkblkgqbsf    worker2   Ready   Active
9yq4lcmfg0382p39euk8lj9p4    worker1   Ready   Active

 $ docker info will give you a detailed info on your swarm
[root@ip-172-31-22-15 ec2-user]# docker info
Containers: 12
Running: 0
Paused: 0
Stopped: 12
Images: 1
Server Version: 1.13.1
Storage Driver: aufs
Root Dir: /var/lib/docker/aufs
Backing Filesystem: extfs
Dirs: 54
Dirperm1 Supported: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge host macvlan null overlay
Swarm: active
NodeID: icuih1r0n8juo8xigkceniu3j
Is Manager: true
ClusterID: hpvfpcevwt8144bj65yk744q8
Managers: 1
Nodes: 6
Orchestration:
.
..
Node Address: 10.91.20.119
Manager Addresses:
10.91.20.119:2377
......
..

now creating a SERVICE and running it on docker swarm
(the whole idea of setting this orchestration layer is, we don't need to worry on our app as where it is running but it will be up for the whole time)

$ docker service  create | scale | ls | ps | inspect | rm  
ex:
$ docker network create -d overlay pp-net
$ docker service scale >> docker service update --replicas
$ docker service scale Name=7
$ docker service ps Name

red@docker:/software/docker-images$ docker service create --name myswarmapp -p 9090:80 punitporwal07/apache
rvzrpe4szt0vdyqte7g7tfshs


by doing this, any time when you gonna hit your exposed port for service to any host/IP in swarm it will give you your application , without having its container running on it. (service will be running only on leader/manager1)

accessing the service now:


NOTE: after advertising listen address to docker swarm, you may get error next time when you try to initialize docker daemon. (if you are using dynamic IP)

/var/lib/docker/swarm/docker-state.json 
/var/lib/docker/swarm/state.json 

will hold the IP and failed to initial docker daemon

ERRO[0001] cluster exited with error: failed to listen on remote API address: listen tcp 10.91.20.119:2377: bind: cannot assign requested address

FATA[0001] Error creating cluster component: swarm component could not be started: failed to listen on remote API address: listen tcp 10.91.20.119:2377: bind: cannot assign requested address

change the IP and initialize it again

service docker restart

k/r,
P

24 January 2018

Networking in docker

Docker works on the principal of running containers as a service, when you run a container it has its own attributes like namespace ip-address port etc. This attributes are allocated to containers by docker daemon at run time. There are ways to control this behavior like creating namespaces of your choice at the time of launching them.

Same way when it comes to ip-addresses you can create your own docker network which can give a static ip to your container or its underline service. 

docker comes with 5 kind of networking drivers:

bridge : when you want to communicate between standalone containers.
overlay : to connect multiple Docker daemons together and enable swarm services to communicate with each other.
host : For standalone containers, remove network isolation between the container and the Docker host. 
macvlan : Allow you to assign a MAC address to  container, making it appear as a physical device on your network.
none : disables all networking.

by default bridge is the default driver that got created when you launch any of the container as service.

How one can create its own docker network as per requirement 

the syntax to create a network is : 

$ docker network create --options networkname

few widely used options are:

--driver drivername
--subnet=subnetrange/x
--gateway=anIPfromdefinedsubnet

for example assigning static IP out of your your CIDR block

$ docker network create --driver overlay --subnet=192.168.0.0/26 --gateway=192.168.0.1 my-network

to list out all the available network use 

$ docker network ls

additionally you can use this created network for your container at the the time of its launch

for example:

$ docker run --publish 61000:1414 --publish 61001:9443 --net my-network --ip 192.168.0.3 --detach --env
  MY_APP_PASSWORD=password punitporwal07/apache:2.2.29

this way your container will be allocated with an static IP within your defined subnet range.

k/r
P

23 November 2017

Docker: Containerization Tool

Docker allows you to encapsulate your application, operating system and hardware configuration into a single unit to run it anywhere.

Its all about applications, and every application require tons of Infrastructure, which is massive waste of resources since it utilize very less % of it. I mean with Physical Machine/ram/CPU results heavy loss of cost & bla bla.. hence Hypervisor/Virtualization came into picture, where we use shared resources on top of a single physical machine and create multiple VMs to utilize more from it but still not perfect.
Docker is the solution of above problem, it can containerize your requirement & works on the principle of layered images.

working with docker is as simple as three steps:
  • Install Docker-engine
  • Pull the image from HUB/docker-registry
  • Run image as a container/service
How containers evolved over Virtualization
-In virtual era you need to maintain guest OS on host OS in form of virtualization which boots up in minutes or so.
whereas containers by pass gust OS from host OS in containerization & boots up in fraction of seconds
- It is not replacing the virtualization, it is just the next step in evolution (more advanced)

What is docker?
Docker is a containerization platform which can bundle up technologies and packages your application and all it dependencies together in the form of image which further you run as a service called container so as to ensure that your application will work in any environment be it Dev/Test/Prod

Point to remember
  • docker images are the read-only template & used to run containers
  • docker images are the build component of docker
  • There is always a base image on which you layer up your requirement
  • container are the actual running instances of the images
  • we always create images and run container using images
  • we can pull images from docker hub/registry can be public/private
  • docker daemon runs on host machine
  • docker0 is not a normal interface | Its a Bridge | Virtual Switch | that links multiple containers
  • Docker images are registered in Docker registry & stored in docker hub
  • Docker hub is docker's own cloud repository (for sharing & caring purpose of images)
Essence of docker: if you are new to any technology and want to work on it, get its image from docker hub configure it, work on it, destroy it, then you can move same image to other environment and run as it is out there .   
                          
                      
key attribute of kernel used by containers
  • Namespaces (PID, net, mountpoint, user) Provides Isolation
  • cgroups (control groups)
  • capabilities ( assigning privileges to container users)
  • but each container shares common Kernel
how communication happen b/w docker client & docker daemon
  • Rest API
  • Socket.IO
  • TCP
Dockerfile supports following list of variables

FROM       image:tag AS name
ADD        ["src",... "dest"]
COPY       /src/ dest/
ENV        ORACLE_HOME=/software/Oracle/
EXPOSE     port, [port/protocol]
LABEL      multi.label1="value1" multi.label2="value2" other="value3"
STOPSIGNAL
USER       
myuser
VOLUME     /myvolume
WORKDIR    /locationof/directory/
RUN        write your shell command
CMD        ["executable","param1","param2"]
ENTRYPOINT ["executable","param1","param2"] (exec form, preferred)
ENTRYPOINT command param1 param2 (shell form)
ENTRYPOINT script ; /bin/bash

Some arguments which you can use while running any docker Image
$ docker run -it --privileged image:tag
--privileged will give all capabilities to container and lifts all the limitaion enforced by OS/device, even you can run docker inside docker with it.

Installing docker-engine onto any Ubuntu system

$ sudo apt-get update -y && apt-get install docker.io

this will install docker-engine as a linux service . check engine status by running service docker status if its running you are good to play with docker now. else start docker engine by running service docker start

check docker details installed in your system by running any of these commands

$ docker -v | docker version | docker info

Docker needs root to work for creation of Namespaces/cgroups/etc..


so you need to add your local user to docker group (verify docker group from /etc/group and add your user as:

$ sudo gpasswd -a red docker

then restart your session, alternatively add your user to docker group

$ vi /etc/group 

append your user to docker group and start using docker with your user

Basic commands 
FunctionCommand
pull a docker imagedocker pull reponame:imagename:tag
run an image
docker run parameters imagename:tag
list docker imagesdocker images
list running containers
list container even not running
docker ps
 docker ps -a
build an imagedocker build -t imagename:tag .
remove n processes in one commanddocker rm $(docker ps -a -q)
remove n images in one commanddocker rmi $(docker image -a -q)                                                               
reset docker systemdocker system prune
create mount docker volume create
using mount point
docker run -it -p 8001-8006:7001-7006 --mount type=bind, source=/software/, target=/software/docker/data/ registry.docker/weblogic12213:191004
docker run -it -p 8001-8006:7001-7006
-v data:/software/ registry.docker/weblogic1036:191004
create network                    docker network create --driver bridge --subnet=192.168.0.0/20 --gateway=192.168.0.2 mynetwork
docker run -it -p 8001:8006:7001:7006 
--network=mynetwork registry.docker/weblogic1036:191004         
for more on networkingclick here: networking in docker 

Setting up Jenkins Via Docker on a Linux machine

Open a terminal window and run(Provided Docker is already installed)
$ docker pull punitporwal07/jenkins
$ docker run -d -p 9090:8080 -v jenkins-data:/var/jenkins_home punitporwal07/jenkins

docker run : default command to run any docker container
-d : run the container in detached made(in background) and omit the container ID
-p : port assignation from image to you local setup -p host-port:container-port
-v : Jenkins data to be mapped to /var/Jenkins_home/ directory/volume to one of your file system
punitporwal07/jenkins: docker will pull this image from docker Hub

it will process for 2-3 mins then prompt as:

INFO: Jenkins is fully up and running

to access the jenkins console( http://localhost:9090 ) for the first time you need to provide admin password to make sure it was installed by admin only. & it will prompt admin password during the installation process as something like:

e72fb538166943269e96d5071895f31c

This may also be found at: /var/jenkins_home/secrets/initialAdminPassword

here we are running Jenkins inside docker as a detached container you can use:
$ docker logs to collect jenkins logs

if we select to install recommended plugins which are most useful, Jenkins by default will install:



Best practice to write a Dockerfile
best practice is to build a container first, run all the instructions one by one that you are planning to put in a Dockerfile. Once they got succeed you can put them in your Dockerfile, which will avoid you building n images from your Dockerfile again and again and save image layers as well.

Writing a docker File: ( FROM COPY RUN CMD)

a Container runs on level of images:
            base image
            layer1 image
            layer2 image

Dockerfiles are simple text files with a command on each line.
To define a base image we use the instruction FROM 

Creating a Dockerfile
  • The first line of the Dockerfile should be FROM nginx:1.11-alpine (it is better to use exact version rather then writing it as latest, as it can deviate your desired version)
  • COPY allows you to copy files from the directory containing the Dockerfile to the container's image. This is extremely useful for source code and assets that you want to be deployed inside your container.
  • RUN allows you to execute any command as you would at a command prompt, for example installing different application packages or running a build command. The results of the RUN are persisted to the image so it's important not to leave any unnecessary or temporary files on the disk as these will be included in the image & it will create a image for each command
  • CMD is used to execute any single command as soon as container launch

Life of a docker Image
write a Dockerfile > build the image > tag the image > push it to registry > pull it back to any system > run the image 

vi Dockerfile: 

FROM baseLayer:version
MAINTAINER xxx@xx.com
RUN install
CMD special commands/instructions

$ docker build -t imagename:tag .
$ docker tag 4a34imageidgfg43 punixxorwal07/image:tag
$ docker push punixxorwal07/image:tag
$ docker pull punixxorwal07/image:tag
$ docker run -it -p yourPort:imagePort punixxorwal07/image:tag

How to Upload/Push your image to registry

after building your image (docker build -t imageName:tag .) do the following:

step1- login to your docker registry
$ docker login --username=punitporwal --email=punixxorwal@xxxx.com

list your images
$ docker images

step2- tag your image for registry
$ docker tag b9cc1bcac0fd reponame/punitporwal07/helloworld:0.1

step3- push your image to registry
$ docker push reponame/punitporwal07/helloworld:0.1

your image is now available and open for world, by default your images is public.

repeat the same step if you wish to do any changes in your docker image, make the changes, tag the new image, push it to you docker hub


Volumes in Docker

first of all create volume for your docker container using command

$ docker volume create myVolume
$ docker volume ls 
DRIVER              VOLUME NAME
local               2f14a4803f8081a1af30c0d531c41684d756a9bcbfee3334ba4c33247fc90265
local               21d7149ec1b8fcdc2c6725f614ec3d2a5da5286139a6acc0896012b404188876
local               myVolume

there after use following way to use volume feature
we can define volumes in one container and same can be share across multiple containers

to define in container 1
$ docker run -it -v /volume1 --name voltainer centos /bin/bash

to call in another container from other container
$ docker run -it --volumes-from=voltainer centos /bin/bash

we can call Volumes in a container from Docker engine host
$ docker run -v /data:/data
$ docker run --volume mydata:/mnt/mqm

     /volumeofYourHost/:/volumeofContainer/

to define in a Dockerfile
VOLUME /data (but we cannot bind the volume from docker host to container via this, just docker run command can do this)


PORT MAPPING

when you expose a port from Dockerfile that means you are mapping a port defined in your image to your newly launched container , use:
$ docker run -d -p 5001:80 --name=mycontaniername myimagename

when you want to change the protocol from default i.e tcp to udp , use:
$ docker run -d -p 5001:80/udp --name=mycontinername myimagename

lets say when you want to expose your image port to any specific IP address from your docker host, use:
$ docker run -d - -p 192.168.0.100:5002:80 --name=mycontaniername myimagename

when you want to map multiple ports exposed in your Dockerfile to high random available ports , use:
$ docker run -d -P --name=mycontaniername3 myimagename

to expose a port range, use:
$ docker run -it -p 61000-61006:61000-61006 myimagename:myimagetag
                  also you can use EXPOSE 61000-61006 in your Dockerfile

to check port mapping , use:
$ docker port myimagename


DOCKER DAEMON LOGGING

first of all stop the docker service
$ service docker stop
$ docker -d -l debug &
-d here is for daemon
-l log level
& to get our terminal back
or
$ vi /etc/default/docker/
add log-level
DOCKER_OPTS="--log-level=fatal"
then restart docker deamon
$ service docker start


Br
Punit