How to build smaller Docker containers

https://www.youtube.com/watch?v=wGz_cbtCiEA

In this episode of Kubernetes Best Practices, Sandeep Dinesh shows how you can build small containers to make your Kubernetes deployments faster and more secure. See the associated article here → https://goo.gl/zjejFj Google Container Registry → https://goo.gl/ilwubv Google Container Builder → https://goo.gl/l1Obc1 Container Registry Vulnerability Scanning → https://goo.gl/5EiyLe Google Kubernetes Engine → https://goo.gl/2V8yah Docker Multistage Builds → https://goo.gl/nQmwW4

Proper proxy setting for Docker

https://stackoverflow.com/questions/50148644/what-is-the-proper-proxy-settings-for-docker-and-kubernetes



We always include the scheme in our environment variables.

/etc/profile.d/proxy.sh:

#!/bin/bash
export http_proxy=http://:3128
export https_proxy=$http_proxy
export no_proxy=169.254.169.254,localhost,127.0.0.1
export HTTP_PROXY=$http_proxy
export HTTPS_PROXY=$https_proxy
export NO_PROXY=$no_proxy

/etc/systemd/system/docker.service.d/proxy.conf:

[Service]
Environment="HTTPS_PROXY=https://:3128/" "HTTP_PROXY=http://:3128/"

 

How to handle specific hostname like -h option in Dockerfile

http://stackoverflow.com/questions/28898787/how-to-handle-specific-hostname-like-h-option-in-dockerfile

I want to install some software which requires resolvable hostname as non-loopback address. If I run a docker image with -h option like

docker run -i -t -h myhost centos:6 /bin/bash

Then I can install the software because /etc/hosts in the container automatically configured like

[root@myhost /]# cat /etc/hosts
172.17.0.7  myhost
127.0.0.1   localhost    

[root@myhost /]# ping myhost
PING myhost (172.17.0.7) 56(84) bytes of data.
64 bytes from myhost (172.17.0.7): icmp_seq=1 ttl=64 time=0.033 ms

But I cannot use same way if I create an image from Dockerfile. I tested creating an image using following Dockerfile

FROM centos:6

ENV HOSTNAME myhost
RUN ping myhost

In docker build process, assigned hostname cannot be resolved as dynamic ip addr like following:

$ docker build -t testimage .
Sending build context to Docker daemon 2.048 kB
Sending build context to Docker daemon
Step 0 : FROM centos:6
 ---> a30bc9f3097e
Step 1 : ENV HOSTNAME myhost
 ---> Using cache
 ---> e73bf592389e
Step 2 : RUN ping myhost
 ---> Running in ca54c8eac073
ping: unknown host myhost
INFO[0000] The command [/bin/sh -c ping myhost] returned a non-zero code: 2

How can I use some specific hostname resolved as dynamic container IP addr?

========================

If you have to do a lot of this, you might try Packer for building containers. It can build Docker containers, but doesn't use multiple layers. This makes it slower to rebuild, faster to download the built images, and makes it more convenient to do multiple operations on an image before freezing it into a container.

Docker networking 101

http://www.dasblinkenlichten.com/docker-networking-101-host-mode/

There are really 4 docker ‘provided’ network modes in which you can run containers…

Bridge mode – This is the default, we saw how this worked in the last post with the containers being attached to the docker0 bridge.

Host mode – The docker documentation claims that this mode does ‘not containerize the containers networking!’.  That being said, what this really does is just put the container in the hosts network stack.  That is, all of the network interfaces defined on the host will be accessible to the container.  This one is sort of interesting and has some caveats but we’ll talk about those in greater detail below.

Mapped Container mode – This mode essentially maps a new container into an existing containers network stack.  This means that while other resources (processes, filesystem, etc) will be kept separate, the network resources such as port mappings and IP addresses of the first container will be shared by the second container.

None – This one is pretty straight forward.  It tells docker to put the container in its own network stack but not to do configure any of the containers network interfaces.  This allows for you to create custom network configuration which we’ll talk about more in a later post.

Keep in mind that all these modes area applied at the container level so we can certainly have a mix of different network modes on the same docker host.

Inter-container communication using Weave

http://xmodulo.com/networking-between-docker-containers.html

How Weave Works

How to install 'nsenter' to host Docker ?

How to install it?

docker run -v /usr/local/bin:/target jpetazzo/nsenter 

This will install nsenter in /usr/local/bin and you will be able to use it immediately. nsenter might also be available in your distro (in the util-linux package).

 

How do I use it?

First, figure out the PID of the container you want to enter:

PID=$(docker inspect --format {{.State.Pid}} container-name)

Then enter the container:

nsenter --target $PID --mount --uts --ipc --net --pid

 You will get a shell inside the container. That’s it. If you want to run a specific script or program in an automated manner, add it as argument tonsenter. It works a bit like chroot, except that it works with containers instead of plain directories.

https://blog.docker.com/tag/nsenter/ 

How to change the default Docker subnet (172.17.42.*)

https://support.zenoss.com/hc/en-us/articles/203582809-How-to-Change-the-Default-Docker-Subnet

http://blog.docker.com/2015/07/online-meetup-22-docker-networking/#more-6780

DOCKER NETWORKING

“We’ll do for Networking, what Docker did for Compute”

Building on top of his talk at DockerCon 2015, Jana Radhakrishnan, Lead Software Engineer at Docker, does a deep dive into Docker Networking with additional demos and insights on the product roadmap.

Below is the recorded video and slides from Jana’s presentation on Docker Networking.

Giving Docker containers static ip addresses

https://it-offshore.co.uk/linux/debian/36-giving-docker-containers-static-ip-addresses

I am currently using Docker to run a Debian build environment with a separate nginx container for a local apt repository (with both containers sharing a data-only container). At the moment there is no functionality in Docker to add a static ip address. It is expected to arrive in docker 1.7 viadocker/libnetwork - see also the Docker Blog. In the meantime the following works:

• Setup your own bridge (e.g br0)
• Start docker with: -b=br0
• Install pipework
• Install arping

Assuming a default gateway ip address of 192.168.1.1:

BASH CODE
 
sudo bash -c "curl https://raw.githubusercontent.com/jpetazzo/pipework/master/pipework > /usr/local/bin/pipework"
sudo chmod +x /usr/local/bin/pipework
sudo pipework br0 container-name 192.168.1.100/24@192.168.1.1
 

You will no longer be able to use docker inspect --format '{{ .NetworkSettings.IPAddress }}' "$@" to find the containers ip address.

A script to create docker data-only containers + a container with an optional static ip address. If the script is re-run to create a container-name that already exists - it will optionally create container-name2 then container-name3 etc...

- The Old Way (pre v 1.0) -

http://shellfu.com/2014/11/docker-assigning-static-ip-addresses-to-containers/

How to expose docker container's ip and port to outside docker host without port mapping?

http://stackoverflow.com/questions/25036895/how-to-expose-docker-containers-ip-and-port-to-outside-docker-host-without-port

You can accomplish this with virtual interface(s) on the host.

First, add a virtual interface on the host that has a different IP address than the primary interface. We'll call the primary interface eth0 with IP 10.0.0.10, and the virtual interface eth0:1 with IP address 10.0.0.11.

 ifconfig eth0:1 10.0.0.11 netmask 255.255.255.0 up 

Now run the containers and map port 5000 to the corresponding interface. For example:

docker run -p 10.0.0.10:5000:5000 -name container1  
docker run -p 10.0.0.11:5000:5000 -name container2  

Now you can access each container on port 5000 using different IP addresses externally.

- OR -

When creating a VM make sure that the following are selected under networking
    Attached to:        Bridged NetworkManager
    Adapter Type:       PCnet-Fast III (Am 79C973)
    Promiscious Mode    Allow All

RHEL 6.5 / Fedora 20
    Install docker, libvrt

    Make sure the following are done using root
        # chkconfig NetworkManager off
        # chkconfig network on  
        # service NetworkManager stop
        # service network start

    create file ifcfg-xxxxx in /etc/sysconfig/network-scripts
        DEVICE=xxxxx
        TYPE=Bridge
        BOOTPROTO=dhcp
        ONBOOT=yes
        DELAY=0

    and append to ifcfg-p2p1 / ifcfg-eth0 at the end of the file BRIDGE=xxxx

Restart the VM
    run 
    brctl show 
    to make sure the bridged connected has an adapter either p2p1 or eth0
    e.g.
        # brctl show
        bridge name     bridge id               STP enabled     interfaces
        gsbr01          8000.080027595649       no              eth0
        virbr0          8000.5254004c1564       yes             virbr0-nic

    now before starting docker we have to use our bridge and not docker0 to do that 

    run docker as
        docker -d -b=gsbr01

    $ echo 'DOCKER_OPTS="-b=gsbr01"' >> /etc/sysconfig/docker
    $ sudo service docker start


    # brctl show
    bridge name     bridge id               STP enabled     interfaces
    gsbr01          8000.080027595649       no              eth0
                                                            veth5806f27
                                                            vethb3e33da
    virbr0          8000.5254004c1564       yes             virbr0-nic

docker -d -b=gsbr01

How to change docker0 net interface using bridge

https://docs.docker.com/articles/networking/#building-your-own-bridge

Building your own bridge

If you want to take Docker out of the business of creating its own Ethernet bridge entirely, you can set up your own bridge before starting Docker and use -b BRIDGEor --bridge=BRIDGE to tell Docker to use your bridge instead. If you already have Docker up and running with its old docker0 still configured, you will probably want to begin by stopping the service and removing the interface:

# Stopping Docker and removing docker0

$ sudo service docker stop
$ sudo ip link set dev docker0 down
$ sudo brctl delbr docker0
$ sudo iptables -t nat -F POSTROUTING

Then, before starting the Docker service, create your own bridge and give it whatever configuration you want. Here we will create a simple enough bridge that we really could just have used the options in the previous section to customize docker0, but it will be enough to illustrate the technique.

# Create our own bridge

$ sudo brctl addbr bridge0
$ sudo ip addr add 192.168.5.1/24 dev bridge0
$ sudo ip link set dev bridge0 up

# Confirming that our bridge is up and running

$ ip addr show bridge0
4: bridge0:  mtu 1500 qdisc noop state UP group default
    link/ether 66:38:d0:0d:76:18 brd ff:ff:ff:ff:ff:ff
    inet 192.168.5.1/24 scope global bridge0
       valid_lft forever preferred_lft forever

# Tell Docker about it and restart (on Ubuntu)

$ echo 'DOCKER_OPTS="-b=bridge0"' >> /etc/default/docker
$ sudo service docker start

# Confirming new outgoing NAT masquerade is set up

$ sudo iptables -t nat -L -n
...
Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  192.168.5.0/24      0.0.0.0/0

The result should be that the Docker server starts successfully and is now prepared to bind containers to the new bridge. After pausing to verify the bridge’s configuration, try creating a container — you will see that its IP address is in your new IP address range, which Docker will have auto-detected.

Just as we learned in the previous section, you can use the brctl show command to see Docker add and remove interfaces from the bridge as you start and stop containers, and can run ip addr and ip route inside a container to see that it has been given an address in the bridge’s IP address range and has been told to use the Docker host’s IP address on the bridge as its default gateway to the rest of the Internet.

How to create file between container and host in Docker

https://medium.com/@gchudnov/copying-data-between-docker-containers-26890935da3f

Copying data between Docker containers

When running docker there are use-cases when you need to copy files and folders into the container or between containers.

There is a `docker cp` command available since the Docker 1.0 that allows you to copy files and folders out of the container. However, if you need to copy from the host to a container or between containers you’re out of luck now. At least, `docker cp` doesn't support that.

One could create a new image each time or mount a data volume, but it is much faster to copy a bunch of files to the running container.

Docker 1.7.0 should have an extended `docker cp` command to support copying data to containers. Until that, you can use one of the alternative solutions.

In this article, I present you a workaround that relies solely on `docker cp` and `docker exec` to partially fill-in the feature we’re missing.

We consider three file copy scenarios:

• from a container’s filesystem to the host path (available, Docker 1.0)
• from the host path to a container’s filesystem (upcoming, Docker 1.7)
• from one container to the other (upcoming, Docker 1.7)

You can skip the implementation details below and get the source code at the bottom of the article.

http://stackoverflow.com/questions/22907231/copying-files-from-host-to-docker-container

The cleanest way is to mount a host dir on the container before running your command.

{host} docker run -v /path/to/hostdir:/mnt $container
{host} docker exec -it $container bash
{container} cp /mnt/sourcefile /path/to/destfile

- or -

$ cd /tmp/somefiles
$ tar -cv * | docker exec -i elated_hodgkin tar x -C /var/www

- or -

tar -cf - foo.sh | docker exec -i theDockerContainer /bin/tar -C /tmp -xf -

Copies the file foo.sh into /tmp of the container.

Where are docker images stored locally ?

http://blog.thoward37.me/articles/where-are-docker-images-stored/

Local Storage on the Docker Host

So far I've been explaining the intricacies of remote storage, and how that relates to the confusing vocabulary, but running docker images shows you only what is local to your machine.
Where is this stuff? The first place to look is in /var/lib/docker/.

Open up the file repositories to find a JSON list of the repositories on your host:

$ sudo cat /var/lib/docker/repositories | python -mjson.tool
{
    "Repositories": {
        "ubuntu": {
            "12.04": "8dbd9e392a964056420e5d58ca5cc376ef18e2de93b5cc90e868a1bbc8318c1c",
            "12.10": "b750fe79269d2ec9a3c593ef05b4332b1d1a02a62b4accb2c21d589ff2f5f2dc",
            "latest": "8dbd9e392a964056420e5d58ca5cc376ef18e2de93b5cc90e868a1bbc8318c1c",
            "precise": "8dbd9e392a964056420e5d58ca5cc376ef18e2de93b5cc90e868a1bbc8318c1c",
            "quantal": "b750fe79269d2ec9a3c593ef05b4332b1d1a02a62b4accb2c21d589ff2f5f2dc"
        }
    }
}

Hey, that matches the output from docker images!

REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
ubuntu              12.04               8dbd9e392a96        8 months ago        131.3 MB (virtual 131.3 MB)
ubuntu              latest              8dbd9e392a96        8 months ago        131.3 MB (virtual 131.3 MB)
ubuntu              precise             8dbd9e392a96        8 months ago        131.3 MB (virtual 131.3 MB)
ubuntu              12.10               b750fe79269d        8 months ago        24.65 kB (virtual 179.7 MB)
ubuntu              quantal             b750fe79269d        8 months ago        24.65 kB (virtual 179.7 MB)

How to enter a Docker

https://blog.codecentric.de/en/2014/07/enter-docker-container/

nsenter
The nsenter tool is part of the util-linux package since version 2.23. It provides access to the namespace of another process. nsenter requires root privileges to work properly. Unfortunately, util-linux is still at version 2.20 in Ubuntu 14.04.

To install the latest version (2.24) proceed as follows:

cd /tmp curl https://www.kernel.org/pub/linux/utils/util-linux/v2.24/util-linux-2.24.tar.gz | tar -zxf- cd util-linux-2.24 ./configure --without-ncurses make nsenter cp nsenter /usr/local/bin

In order to connect to a container, you have to find out the PID of the first process in the container.

docker inspect --format "{{ .State.Pid }}" <container-id>

With that PID you can connect to the container:

nsenter --target $PID --mount --uts --ipc --net --pid

Docker nsenter

https://blog.docker.com/tag/nsenter/

Introducing nsenter

nsenter is a small tool allowing to enter into namespaces. Technically, it can enter existingnamespaces, or spawn a process into a new set of namespaces. “What are those namespaces you’re blabbering about?” They are one of the essential constituants of containers. The short version is: with nsenter, you can get a shell into an existing container, even if that container doesn’t run SSH or any kind of special-purpose daemon.

Where do I get nsenter?

Check jpetazzo/nsenter on GitHub. The short version is that if you run:

docker run -v /usr/local/bin:/target jpetazzo/nsenter

This will install nsenter in /usr/local/bin and you will be able to use it immediately. nsenter might also be available in your distro (in the util-linux package).

How do I use it?

First, figure out the PID of the container you want to enter:

PID=$(docker inspect --format {{.State.Pid}} )

Then enter the container:

nsenter --target $PID --mount --uts --ipc --net --pid

You will get a shell inside the container. That’s it. If you want to run a specific script or program in an automated manner, add it as argument tonsenter. It works a bit like chroot, except that it works with containers instead of plain directories.



Reference:

Backup data, check logs, restart service ... use volume
https://docs.docker.com/userguide/dockervolumes/

Docker Machine

https://vexxhost.com/blog/getting-started-with-docker-in-minutes-using-docker-machine/#.VOjOjXGdvZ4.dzone

Typically, you would have to create a new virtual machine, install multiple Docker components until you’re ready to provision new containers. With Docker Machine, it’s a matter of a single command.

Docker tricks and tips

https://gist.github.com/wsargent/7049221


http://stackoverflow.com/questions/17157721/getting-a-docker-containers-ip-address-from-the-host?rq=1

How to get the container's IP address ?

You can use docker inspect

Example:

> CID=$(docker run -d -p 4321 base nc -lk 4321); > docker inspect $CID -or-

> docker inspect --format '{{ .NetworkSettings.IPAddress }}' ${CID}




How to get the full container ID ?

> docker ps

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

d8e703d7e303 solidleon/ssh:latest /usr/sbin/sshd -D cranky_pare

> docker inspect -f '{{.Id}}' cranky_pare

or

> docker inspect -f '{{.Id}}' d8e703d7e303

d8e703d7e3039a6df6d01bd7fb58d1882e592a85059eb16c4b83cf91847f88e5

Where is the full container ID stored ?
It is in the host file system under /var/lib/docker/aufs/mnt/


How to copy file from host to container ?
Get full container ID as mentioned above and then use the 'cp' command from the host
> sudo cp file.txt /var/lib/docker/aufs/mnt/d8e703d7e3039a6df6d01bd7fb58d1882e592a85059eb16c4b83cf91847f88e5/root/file.txt

How to coy file from container to host ?
>docker cp d8e703d7e303:/file/path/within/container /host/path/target




How to create Docker image with OpenSSH

http://flnkr.com/2013/12/creating-a-docker-ubuntu-13-10-image-with-openssh/

I’ve posted the stephens/sshd image to the docker site and  you can download it with the command: (The root password is password.)

> docker pull stephens/sshd

To run an instance of the image as a daemon, execute:

> docker run -d -p 22 stephens/sshd

To run the image in the foreground and enter the shell, execute:

> docker run -i -t -p 22 stephens/sshd /bin/bash

To connect to the image, first find the port that was assigned to the ssh port and then connect with the ssh client:

> docker ps
> ssh root@localhost -p 

How to upgrade Docker on Ubuntu 14.04 ?

http://askubuntu.com/questions/472412/how-do-i-upgrade-docker
http://xmodulo.com/2014/05/manage-linux-containers-docker-ubuntu.html
http://xmodulo.com/2014/05/docker-containers-centos-fedora.html
https://fredjean.net/running-docker-under-linux-mint-16/

Suppose it is Ubuntu Trusty (14.04) release, which has 0.9.1 officially

Update to 0.11.1 release

If you want to upgrade in this release, see new launchpad https://launchpad.net/~docker-maint/+archive/testing, better use ppa installation.

sudo add-apt-repository ppa:docker-maint/testing
sudo apt-get update
sudo apt-get install docker.io

Now I get the latest one

$ docker -v
Docker version 0.11.1, build fb99f99

Be aware, with the 1.0 GA release, this method may be changed

Update to latest release(now 1.1.1)

This is the way stated to install docker for 12.04 LTS in official document and noticed inubuntuupdates.org, which looks work for 14.04 as well.

Refer the command to Getting Docker Installed on Ubuntu 12.04 LTS as well

$ wget -qO- https://get.docker.io/gpg | sudo apt-key add -
$ sudo sh -c "echo deb http://get.docker.io/ubuntu docker main > /etc/apt/sources.list.d/docker.list"
$ sudo apt-get update
$ sudo apt-get install lxc-docker

Now I get

$ docker -v
Docker version 1.1.1, build bd609d2

lxc-docker will remove old docker package, therefore please backup the configuration in advance.