Docker is a Platform as a Service (PaaS) product that leverages OS-Level Virtualization to deliver software packages referred to as “containers”. These containers are small VMs that run isolated from the host OS and provide software, services, libraries, and config files. The cool thing about Docker is that the containers are easy to setup and remove.

Like Virtual Machines there are a few concepts that containers have that are similar to a traditional bare metal computer:

• CONTAINER: A runtime instance of the Docker image (similar to a VM)
• IMAGE: Like a system image, these are preconfigured
• VOLUME: A place to store persistent data since images are static
• STACK: A cluster of containers that are managed together
• NETWORKS:
• ENV: Environmental variables are used to set the environment for commands, daemons, and processes.

Containerization with Docker

Install Docker Debian (Ubuntu)

Setup the repo:

sudo apt-get update && sudo apt-get install ca-certificates curl gnupg lsb-release -y

Add docker GPG key:

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg

Setup stable repo:

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

Install docker:

sudo apt-get update && sudo apt-get install docker-ce docker-ce-cli containerd.io -y

Docker Commands

Pull a docker image

docker pull <image_name>

Create a docker container from an image

docker -it -d <image_name>

List running containers

docker ps

Show all containers
docker ps -a

Starting a container

docker start <container>

Stopping a container

docker stop <container>

docker kill <container>

Accessing docker container CLI

Execute commands from the host
docker exec -it <container> <command>

Access the container CLI from the host
docker exec -it <container> /bin/bash

Using Docker Compose

Using Docker-Compose is a very easy and efficient way to deploy containers.

first you need to create a YAML file and label it “docker-compose.yml”

vim docker-compose.yml

An example of docker-compose.yml file would look something like this

version: '3'

services:
  db:
    image: <image_name>
    command: --cmd=value --cmd=value
    environment:
      VAR: <value>
      VAR: <value>
    volumes:
      - ./host:/container
    restart: unless-stopped
  frontend:
    image: <image_name>
    environment:
      VAR: value
      VAR: value
    volumes: 
      - ./host:/container
    depends_on:
      - name
    restart: unless-stopped
  backend:
    image: <image_name>
    restart: unless-stopped
  proxy:
    image: <image>
    ports:
      8888:8888
    volumes:
      /host:/container
    depends_on:
      - frontend
      - backend
    restart: unless-stopped

Once the docker-compose file is created, run the following command:

docker-compose up -d

If you get an “Inerpolation Error” with docker (I have run into this before) it might be because you have a character not being translated literally. I ran into this issue with the dollar sigh “$” being mistaken as a variable. In order to escape the dollar sign, you just need to add another (like so “$$”) and it will be taken as 1 literal dollar sign.

Reference: https://docs.docker.com/compose/compose-file/compose-file-v3/

Docker Python Module

pip install docker

Docker Container CLI

Access Container CLI on Host using Bourne Again Shell
docker exec -it <container> /bin/bash

Accessing Container CLI on Host using Almquist Shell
docker exec -it <container> /bin/ash

Accessing Container CLI on Host using Bourne Shell
docker exec -it <container> /bin/sh

Executing Shell Commands on Container from Host
docker exec -it <container> <command>

Building a Docker Registry

version: '3'

services:
  docker-registry:
    image: registry:2
    container_name: registry
    ports:
      - 5000:5000
    restart: unless-stopped
    volumes:
        - /docker/registry:/var/lib/registry

Creating a Docker Image

Creating a Docker image from Scratch

Install Docker package, Docker.io engine and server, as well as the Docker registry

sudo apt install docker docker.io docker-registry

Docker Registry can be downloaded and configured from a docker image as a container itself (which I find more complex but also a lot more useful)

docker run -d -p 5000:5000 --restart=always --name registry registry:2

Config file

/etc/docker/registry

Use boostrap to create a Debain image

apt install bootstrap
deboostrap buster buster

Creating a Container from an Existing Image

Using the command ‘docker commit’ we are able to sav the current container (and all of the contents of it) as a new image.

Pull the ubuntu image (you can pull anything like alpine, debian, or arch, I just used ubuntu)

docker pull ubuntu

Run up the image

docker run -it -d ubuntu --name ubuntu

Once you have the image installed, enter into a shell on the new container

docker exec -it ubuntu /bin/bash

Make any configurations, download packages or whatnot that you need to do in the CLI, then exit.

docker stop ubuntu

Saved changes with docker commit

docker image tag ubuntu localhost:5000/<name>

Pushing a Docker Image to a Repository

Portainer Web UI (Docker)

Portainer is a Web User Interface for Docker.

Pull the image:

docker volume create portainer_data

Use Docker run to deploy the container:

docker run -d -p 8000:8000 -p 9000:9000 --name=portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v /mnt/docker/images/staging/portainer/data:/data portainer/portainer-ce

You can access the portainer web interface over port 9000. You will need to initially setup by entering a username and password

Reference: https://docs.portainer.io/v/ce-2.9/start/install/server/docker/linux

Watchtower (Update Containers Automatically)

Watchtower is an application that will monitor your running Docker containers and watch for changes to the images that those containers were originally started from. If watchtower detects that an image has changed, it will automatically restart the container using the new image.

Watchtower is a containerized application that runs inside of Docker and monitors existing containers that are running and monitors for the latest image updates in the Docker hub. When Watchtower observes a new image, it pulls that image and restarts the container with that new image automatically

Deploy Watchtower Container

Docker

docker run -d --name=watchtower --restart=always -v /var/run/docker.sock:/var/run/docker.sock containrrr/watchtower

ENABLE MODE allows Watchtower to only update specifically flagged containers with the following label

LABEL com.centurylinklabs.watchtower.enable="true"

MONITOR MODE prompts Watchtower to notify of container updates but will not update them automatically

To FULL EXCLUDE a container, add the following label in the container that you do not want to be updated by Watchtower

LABEL com.centurylinklabs.watchtower.enable="false"

Run Watchtower Once (then Exit)

This will start a running Watchtower container.
Set Watchtower to RUN ONCE and close afterwards:

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock containrrr/watchtower --run-once

You can add container names to the end of the command to only run on specific containers

Reference: https://hub.docker.com/r/containrrr/watchtower

Converting VMDK to Docker Image

Convert the WEMU image into a raw image:

sudo -img convert -f vmdk -O raw diskimage.vmdk image.img

After the Raw image is created, apply Guestfish:

guestfish -a image.img --ro
><fs> run

><fs> list-filesystems
/dev/sda1: ext4
/dev/VolGroup/lv_root: ext4
/dev/VolGroup/lv_swap: swap
><fs> mount /dev/VolGroup/lv_root /
><fs> tar-out / - | xz --best >>  myimage.xz
><fs> exit

Import the image into Docker:

cat mytry.xz | docker import - mydockerimage

Run the container:

docker run -it mydockerimage bash

Reference: https://blog.inslash.com/how-to-convert-vmdk-to-a-docker-image-be939745ed8a

Add a Docker Network with NO Internet Access

docker network create --subnet 172.19.0.0/16 no-internet

sudo iptables --insert DOCKER-USER -s 172.19.0.0/16 -j REJECT --reject-with icmp-port-unreachable

sudo iptables --insert DOCKER-USER -s 172.19.0.0/16 -m state --state RELATED,ESTABLISHED -j RETURN

Connect Docker Container to Host Network

Install Packages in Docker Container with APK

This is useful for docker containers that don’t use APT:

apk update && apk add vim