KEMBAR78
Docker introduction for Carbon IT | PDF
Introduction to Docker
The lightweight, portable, flexible containers
A bit of history
● FreeBSD Jails circa 2000
● Solaris Zones circa 2004
● LXC (Google) circa 2008
● Systemd-nspawn circa 2010-2013
● Docker circa 2013
○ built on LXC
○ moved to libcontainer (March 2014)
○ appC (CoreOS) announced (December 2014)
○ Open Containers standard for convergence with Docker Announced (June
2015)
○ moved to runC (OCF compliant) (July 2015)
So what is a container, technically ?
● Containers share the host kernel
● Containers use the kernel ability to group processes for
resource control
● Containers ensure isolation through namespaces
● Containers feel like lightweight VMs (lower footprint,
faster)
Components of a container ecosystem include:
● Runtime
● Image distribution
● Tooling
But we have Virtual Machine !
● Performance cost ? Not so much
● Less efficient. On the same bare-metal server, many
duplicate instances of the same OS and many redundant
boot volumes
● Slower to start and stop
● Less DevOps friendly
● However more secure and easier to constrain (important
for a public cloud operator)
Good slides comparing Containers vs VMs
Overlook of Docker Containers vs Virtual Machines
Two building blocks for containers
Linux namespaces, originally developed by IBM, deal with
resource isolation (Users, PID, Mount, Network...)for a
single process.
Linux cgroups, originally developed by Google, allow
processes to be organized into hierarchical groups whose
usage of various types of resources (CPU, memory..) can then
be limited and monitored.
Image & Layers
At start, a container
prepares rootfs & uses
chroot for the container
filesystem isolation
Docker uses Union File
Systems to speed up and
reduce size which provide:
● Layering
● Copy-On-Write
● Caching
● Diffing
Diving into docker
Mainly:
● Ecosystem & architecture
● Image DSL
● Container lifecycle
● Networking
● Volume
Docker ecosystem
Docker architecture
Docker - Image DSL example
FROM ubuntu
RUN apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 7F0CEB10 && echo 'deb
http://downloads-distro.mongodb.org/repo/ubuntu-upstart dist 10gen' | tee
/etc/apt/sources.list.d/mongodb.list
RUN apt-get update && apt-get install -y mongodb-10gen
RUN mkdir -p /data/db
EXPOSE 27017
CMD ["--port 27017"]
ENTRYPOINT usr/bin/mongod
Docker container lifecycle
Networking
Linux Bridge (for creating virtual
switches) together with IPTables
functionality to create isolated
container networks and expose
container ports.
Also easy communication with
internal DNS between container in
the same network
Data
Volumes are stored in a part
of the host filesystem which
is managed by Docker
(/var/lib/docker/volumes/ on
Linux).
Bind mounts may be stored
anywhere on the host system.
tmpfs mounts are stored in
the host system’s memory
only.
Links
● https://www.infoworld.com/article/3204171/linux/what-is-d
ocker-linux-containers-explained.html
● http://docker-saigon.github.io/post/Docker-Internals/
● https://www.youtube.com/watch?v=sK5i-N34im8&t=3s
● https://github.com/wsargent/docker-cheat-sheet
● https://dmitryfrank.com/projects/docker-quick-ref
● https://veggiemonk.github.io/awesome-docker/

Docker introduction for Carbon IT

  • 1.
    Introduction to Docker Thelightweight, portable, flexible containers
  • 3.
    A bit ofhistory ● FreeBSD Jails circa 2000 ● Solaris Zones circa 2004 ● LXC (Google) circa 2008 ● Systemd-nspawn circa 2010-2013 ● Docker circa 2013 ○ built on LXC ○ moved to libcontainer (March 2014) ○ appC (CoreOS) announced (December 2014) ○ Open Containers standard for convergence with Docker Announced (June 2015) ○ moved to runC (OCF compliant) (July 2015)
  • 4.
    So what isa container, technically ? ● Containers share the host kernel ● Containers use the kernel ability to group processes for resource control ● Containers ensure isolation through namespaces ● Containers feel like lightweight VMs (lower footprint, faster) Components of a container ecosystem include: ● Runtime ● Image distribution ● Tooling
  • 5.
    But we haveVirtual Machine ! ● Performance cost ? Not so much ● Less efficient. On the same bare-metal server, many duplicate instances of the same OS and many redundant boot volumes ● Slower to start and stop ● Less DevOps friendly ● However more secure and easier to constrain (important for a public cloud operator) Good slides comparing Containers vs VMs
  • 6.
    Overlook of DockerContainers vs Virtual Machines
  • 7.
    Two building blocksfor containers Linux namespaces, originally developed by IBM, deal with resource isolation (Users, PID, Mount, Network...)for a single process. Linux cgroups, originally developed by Google, allow processes to be organized into hierarchical groups whose usage of various types of resources (CPU, memory..) can then be limited and monitored.
  • 8.
    Image & Layers Atstart, a container prepares rootfs & uses chroot for the container filesystem isolation Docker uses Union File Systems to speed up and reduce size which provide: ● Layering ● Copy-On-Write ● Caching ● Diffing
  • 9.
    Diving into docker Mainly: ●Ecosystem & architecture ● Image DSL ● Container lifecycle ● Networking ● Volume
  • 10.
  • 11.
  • 12.
    Docker - ImageDSL example FROM ubuntu RUN apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 7F0CEB10 && echo 'deb http://downloads-distro.mongodb.org/repo/ubuntu-upstart dist 10gen' | tee /etc/apt/sources.list.d/mongodb.list RUN apt-get update && apt-get install -y mongodb-10gen RUN mkdir -p /data/db EXPOSE 27017 CMD ["--port 27017"] ENTRYPOINT usr/bin/mongod
  • 13.
  • 14.
    Networking Linux Bridge (forcreating virtual switches) together with IPTables functionality to create isolated container networks and expose container ports. Also easy communication with internal DNS between container in the same network
  • 15.
    Data Volumes are storedin a part of the host filesystem which is managed by Docker (/var/lib/docker/volumes/ on Linux). Bind mounts may be stored anywhere on the host system. tmpfs mounts are stored in the host system’s memory only.
  • 16.
    Links ● https://www.infoworld.com/article/3204171/linux/what-is-d ocker-linux-containers-explained.html ● http://docker-saigon.github.io/post/Docker-Internals/ ●https://www.youtube.com/watch?v=sK5i-N34im8&t=3s ● https://github.com/wsargent/docker-cheat-sheet ● https://dmitryfrank.com/projects/docker-quick-ref ● https://veggiemonk.github.io/awesome-docker/