Tips and tricks of the docker captains

Tips and Tricks of
the Docker Captains

●
●
Tricks of the Captains

docker ps
docker container ls
$ docker ps
CONTAINER ID IMAGE COMMAND ...
0f1f72c9aac0 nginx "nginx -g 'daemon ...
Configure docker ps Output

--format
$ docker ps --format
"table {{.Names}}t{{.Image}}t{{.Status}}"
NAMES IMAGE STATUS
web nginx Up 25 minutes

config.json
$ cat ~/.docker/config.json
{...
"psFormat":
"table {{.ID}}t{{.Names}}t{{.Image}}t{{.Status}}"}

$ kubectl completion --help
$ source <(kubectl completion bash)
$ kubectl g<TAB> de<TAB>
Getting Started with kubectl

$ cat index.html
Moby Rules!
$ docker run -d -p 8000:80
-v $PWD/index.html:/usr/share/nginx/html/index.html nginx
0cdacef2cbaea960f710d90900b23c57550aaf626ccd2752f3a9287b7e5
$ curl localhost:8000
Moby Rules!
File Mounting Gotcha

$ vi index.html
...
$ cat index.html
Gordon the Turtle Rules!
$ curl localhost:8000
Moby Rules!
?

●
○ -v $PWD:/usr/share/nginx/html
●
○ cp new.html index.html
●
○ echo “bla” > index.html

<none>
$ docker image prune
WARNING! This will remove all dangling images.
Are you sure you want to continue? [y/N] y
Deleted Images:
deleted:
sha256:708624719836212ccb681d5898a64ebfcc4569f3746053766db6
…
Total reclaimed space: 3.677 GB
Cleaning Up

$ docker container prune
WARNING! This will remove all stopped containers.
Deleted Containers:
6e5033be3e106d04912fb91b966abc693b77ae47d85946190bdbe73c4811
…
Total reclaimed space: 304.6 MB
Cleaning Up

$ docker volume prune
WARNING! This will remove all volumes not used by at least
one container.
…
Total reclaimed space: 3.494 GB
$ docker network prune
WARNING! This will remove all networks not used by at least
one container.
Deleted Networks:
...
Cleaning Up

$ docker system prune
WARNING! This will remove:
- all stopped containers
- all volumes not used by at least one container
- all networks not used by at least one container
- all dangling images
Cleaning Up

$ docker build -t myimage .
●
● ~/ Downloads
● .dockerignore
The Build Context

Don’t Bust the Build Cache
...
COPY ./ /usr/src/
RUN npm install
...
...
COPY package.json
/usr/src/
RUN npm install
COPY ./ /usr/src/
...

●
○
●
○
Minimal Images

●
○
○
●
○
Minimal Images

FROM rust:1.20 as builder
…
RUN cargo build --release --target x86_64-unknown-linux-musl
FROM scratch
COPY --from=builder /.../release/mybin /mybin
USER 65534
CMD ["/mybin"]
Minimal Images

●
●
●
docker push/pull/build myimage ==
docker push/pull/build myimage:latest
Beware of “latest”

●
○ docker build -t myimage:1.2.1 .
●
○ docker tag myimage:1.2.1
myimage:$(git rev-parse --short HEAD)
Use Meaningful Tags

$ docker build --label
org.opencontainers.image.created=
"$(date --rfc-3339=s)" -t myimage .
...
$ docker inspect
-f "{{json .ContainerConfig.Labels}}" myimage
{"org.opencontainers.image.created":"2017-10-05
16:21:00+01:00"}
And Labels for the Rest

●
●
○
○
●
○
Start Up Dependably

● SIGTERM
●
● SIGKILL
Shutdown Gracefully

SIGTERM
●
○
○
○
●
Shutdown Gracefully

●
○ exec
●
○
●
○
Shutdown Gracefully

●
●
●
○
Use Healthchecks

FROM nginx
RUN apt-get update && apt-get install -y curl
HEALTHCHECK --interval=10s --timeout=3s
CMD curl -f http://localhost/ || exit 1
Swarm Mode Healthchecks

●
○
●
○
○
○
●
Swarm Mode Healthchecks

●
○
○
○
●
○
Kubernetes Healthchecks

...
containers:
- name: example
image: myapp
livenessProbe:
httpGet:
path: /healthz
port: 8080
Kubernetes Healthchecks

$ docker run -d --name n1 --read-only -p 8000:80
--tmpfs /var/run --tmpfs /var/cache/nginx nginx
c1da395bec73ef7933fecb6d8d821140ce203c426c433e5102d25e46cdb66
$ docker exec n1 /bin/bash -c
'echo "HACKED" > /usr/share/nginx/html/index.html'
/bin/bash: /usr/share/nginx/html/index.html: Read-only file
system
Read Only Filesystem

USER
FROM debian
RUN groupadd -r mygroup && useradd -r -g mygroup myuser
…
USER myuser
nobody
Don’t Run as Root

$ docker run debian-with-sudo sudo -u nobody ps ax
PID TTY STAT TIME COMMAND
1 ? Rs 0:00 sudo -u nobody ps ax
7 ? R 0:00 ps ax
Don’t Run as Root

$ docker run debian-with-gosu gosu nobody ps ax
PID TTY STAT TIME COMMAND
1 ? Rs 0:00 ps ax
Don’t Run as Root

●
○
●
○
○
Docker in Docker

$ docker run
-v /var/run/docker.sock:/var/run/docker.sock
docker
docker ps
8bdba5bc5c7a docker "docker-entrypoint.sh" ...
Docker in Docker

$ docker run --privileged --name dind -d docker:dind
4b78ae49d77dcf3c2e169c9e4440ace0813676f76e998f0aea2ef065a4b
$ docker exec dind docker run -d nginx
Unable to find image 'nginx:latest' locally
latest: Pulling from library/nginx
...
$ docker exec dind docker ps
983cd6cb5a82 nginx "nginx -g 'daemon off" ...
Docker in Docker

$ docker run -d
-v /tmp/.X11-unix:/tmp/.X11-unix
-e DISPLAY=unix$DISPLAY
--device /dev/snd:/dev/snd
--name spotify
jess/spotify
Docker and GUIs

Thanks For Listening!
@adrianmouat

Good Defaults for Node and Docker - Bret Fisher
12 Fractured Apps - Kelsey Hightower
Least Privilege Containers - Nathan McCauley and Diogo Monica
Gosu - sudo for containers by Tianon Gravi
tini - minimal init system for containers by Thomas Orozco
Docker Containers on the Desktop - Jessie Frazelle
Frequently Asked Queries from StackOverflow - Brandon Mitchell
References

Docker Features for Handling Container Death and Resurrection by
Sreenivas Makam
Creating Effective Docker Images - Abby Fuller
Multi-stage builds - Alex Ellis
Do Not Use DinD For CI - Jérôme Petazzoni
Docker Healthchecks - Elton Stoneman
Annotations in the OCI image spec
Thanks to all the captains for discussions!
References

Tips and tricks of the docker captains

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Mehr von Docker, Inc.

Mehr von Docker, Inc. (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Tips and tricks of the docker captains