Container fundamentals

▶ Containers are a form of operating system virtualization. A single container might be used to run anything
from a small microservice or software process to a larger application. Inside a container are all the necessary
executables, binary code, libraries, and configuration files.
▶ A container is a standard unit of software that packages up code and all its dependencies so the
application runs quickly and reliably from one computing environment to another. Available for both
Linux and Windows-based applications, containerized software will always run the same, regardless of the
infrastructure.
Containers are small, fast, and portable because unlike a virtual machine, containers do not need include a
guest OS in every instance and can, instead, simply leverage the features and resources of the host OS.
 becausvirtual machine, containers do not need include a guest OS in every instance and
can,instead, simply leverage the features and
CONTAINERS VS. VIRTUAL MACHINES (VMS)

▶ In traditional virtualization—whether it be on- premises or in the cloud—a

hypervisor is leveraged to virtualize physical hardware. Each VM then contains a
guest OS, a virtual copy of the hardware that the OS requires to run, along with an
application and its associated libraries and dependencies.
▶ Instead of virtualizing the underlying hardware, containers virtualize the operating
system (typically Linux) so each individual container contains only the application
and its libraries and dependencies. The absence of the guest OS is why containers
are so lightweight and, thus, fast and portable.
BENEFITS OF CONTAINERS

The primary advantage of containers, especially compared to a VM, is providing a

level of abstraction that makes them lightweight and portable.
 Lightweight: Containers share the machine OS kernel, eliminating the need for
a full OS instance per application and making container files small and easy on
resources.
 Portable and platform independent: Containers carry all their dependencies
with them, meaning that software can be written once and then run without
needing to be re-configured across laptops, cloud, and on-premises computing
environments.
▶ Supports modern development and architecture: Due to
deployment portability/consistency across platforms and their small
size, containers are an ideal fit for modern development and
application patterns—such as DevOps, serverless, and
microservices—that are built are regular code deployments in small
increments.
▶ Improves utilization: Like VMs before them, containers enable
developers and operators to improve CPU and memory utilization of
physical machines.
USE CASES FOR CONTAINERS
 Microservices: Containers are small and lightweight, which makes them a good match for
microservice architectures where applications are constructed of many, loosely coupled and
independently deployable smaller services.
 DevOps: The combination of microservices as an architecture and containers as a platform is a
common foundation for many teams that embrace DevOps as the way they build, ship and run
software.

Hybrid, multi-cloud: Because containers can run consistently anywhere, across laptop, on-premises and
cloud environments, they are an ideal underlying architecture for hybrid cloud and multicloud
scenarios.

 Application modernizing and migration: One of the most common approaches to application
modernization starts by containerizing them so that they can be migrated to the cloud.
CONTAINERIZATION
The process includes packaging an application with its relevant environment
variables, configuration files, libraries, and software dependencies. The result
is a container image that can then be run on a container platform.
CONTAINERS VERSUS VIRTUAL MACHINES
 CONTAINERS VERSUS VIRTUAL MACHINES
▶ Containers provide a way to virtualize an OS so that multiple
workloads can run on a single OS instance.
▶ With VMs, the hardware is being virtualized to run multiple OS
instances.
CONTAINERS VS. VIRTUAL MACHINES

Feature Virtual machine Container

Isolation Provides complete isolation from the Typically provides lightweight isolation
host operating system and other VMs. from the host and other containers, but
This is useful when a strong security doesn't provide as strong a security
boundary is critical, such as hosting apps boundary as a VM.
from competing companies on the same
server or cluster.

Operating system Runs a complete operating system Runs the user mode portion of an operating
including the kernel, thus requiring more system, and can be tailored to contain just
system resources (CPU, memory, and the needed services for your app, using
storage). fewer system resources.
Guest Runs just about any operating Runs on the same operating system
compatibility system inside the virtual machine. version as the host (Hyper-V
isolation enables you to run earlier
versions of the same OS in a
lightweight VM environment)

Deployment Deploy individual VMs by using Deploy individual containers by

Windows Admin Center or Hyper-V using Docker via command line;
Manager; deploy multiple VMs by deploy multiple containers by using
using PowerShell or System Center an orchestrator such as Azure
Virtual Machine Manager. Kubernetes Service.
Load balancing Virtual machine load balancing Containers themselves don't move;
moves running VMs to other instead an orchestrator can
servers in a failover cluster. automatically start or stop
containers on cluster nodes to
manage changes in load and
availability.

Fault tolerance VMs can fail over to another If a cluster node fails, any
server in a cluster, with the containers running on it are
VM's operating system rapidly recreated by the
restarting on the new server. orchestrator on another cluster
node.
DIFFERENT CONTAINER TECHNOLOGIES

▶ Container runtimes
▶ Docker was the first major open-source container offering, and
quickly emerged as a de facto standard. Now Kubernetes is
evolving as the new standard for clusters and cluster management.
▶ Kubernetes initially supported Docker and rkt (or "rocket")
through custom code. But now, with the creation of the Container
Runtime Interface (CRI), you have many ways to store virtual
machines and at the same time communicate through that interface.
What is clustering..??

▶ A computer cluster is a group of two or more computers, or nodes,

that run in parallel to achieve a common goal. This allows workloads
consisting of a high number of individual, parallelizable tasks to be
distributed among the nodes in the cluster. As a result, these tasks can
leverage the combined memory and processing power of each
computer to increase overall performance.
▶ Docker
 The first and still most popular container technology, Docker's open-
source containerization engine works with most of the products that
follow, as well as many open-source tools.
▶ Docker Enterprise
 This set of extensions not only adds features to Docker, but also
makes it possible for Docker (the company) to add commercial
support.
▶ CRI-O
 The first implementation of the Container Runtime Interface, CRI-O is
an incredibly lightweight, open-source reference implementation.
▶ rktlet
 The aforementioned rkt, redesigned and retooled to use the CRI as
rktlet, now has a set of supported tools and community to rival Docker.
 rkt is a container system developed by CoreOS as a light weight and
secure alternative to Docker. It is built based on an open container
standard known as “App Container” or “appc” specification.
▶ containerd
 A project of the Cloud Native Computing Foundation, containerd was an
early container format. More recently the developers of containerd built a
CRI plugin that lets Kubernetes run containerd in the same way it runs
rktlet or CRI-O.
▶ Microsoft Containers
 Positioned as an alternative to Linux, Microsoft Containers can support
Windows containers under very specific circumstances. They generally
run in a true virtual machine and not in a cluster manager like Kubernetes.
▶ Cluster management and deployment
 Cluster management tools manage workloads, including
moving instances from one virtual host to another based on
load, and allocate resources such as CPU and memory.
▶ Kubernetes
▶ Supported by Amazon's AWS, Google's Cloud Engine (GCE) and
Microsoft's Azure Container service, Kubernetes is relatively portable.
▶Kubernetes can even run on a private cloud: OpenStack. Microsoft,
Amazon, and Google all provide container services that run
Kubernetes—with commercial support options available.
▶ Istio and Envoy
 Envoy and Istio are open-source service mesh technologies that
add a layer to provide security and observability. They can
encrypt traffic inside of the cluster while observing it. Istio includes
Envoy, sits on top of it, and adds several plugins, dashboards, and
other features to extend it.
▶ Apache Mesos
 An open source cluster manager that handles workloads in a distributed
environment through dynamic resource sharing and isolation. Mesos is
suited for the deployment and management of applications in large-
scale clustered environments.
▶ Docker Swarm
 Docker swarm is a container orchestration tool, allows the user to
manage multiple containers deployed across multiple host machines.
One of the key benefits associated with the operation of a docker
swarm is the high level of availability offered for applications.
 ▶ Docker Datacenter
 Designed as a drop-in replacement that lets you containerize your entire data
center, and it includes commercial support.
 Containers as a Service (CaaS) platform for enterprise IT and
application teams to build, ship and run, any application anywhere.
 It works with Docker Enterprise.
Storage containers
Storage and databases need persistent locations to house data, or at least a
standard interface layer. Organizations that want to move to an all-container
infrastructure need storage.
 Configuring a container engine
▶ The practice of isolating a piece of software so that it can access only certain resources,
programs, and files within a computer system, so as to reduce the risk of errors or
malware affecting the rest of the system.
▶ So, there are mechanisms to limit the number of resources that a container can take
ownership of.
▶ Constraining resources
⇒ Docker provides mechanisms to limit the amount of CPU, memory and RAM that a
container can use when it is being started.
▶ Setting CPU share
⇒ The amount of CPU share a container takes up can be controlled using the -c
option in the docker run command: → $ docker run -c 10 -it ubuntu /bin/bash
⇒ The value, 10, is the relative priority given to this container with respect to other
containers. → By default, all containers get the same priority, and hence the same ratio
of CPU processing cycles, which you can check out by running.
▶ Setting memory limit
⇒ Similarly, the amount of RAM that a container is allowed to consume
can also be limited while starting the container:
→ $ docker run -m <value><optional unit>
⇒ Here, unit can be b, k, m, or g, representing bytes, kilobytes,
megabytes, and gigabytes, respectively).
⇒ An example of a unit can be represented as follows:
→ $ docker run -m 1024m -dit ubuntu /bin/bash
→ This sets a memory limit of 1 GB for the container.
Managing data in containers with volumes
It is managed directly by the docker daemon (Docker Daemon: A persistent background
process that manages Docker images, containers, networks, and storage
 volumes) and can be shared across containers.
▶ Data-only container
⇒ A data-only container is a container that does nothing except exposing a
volume that other data-accessing containers can use.
⇒ Data-only containers are used to prevent volumes from being destroyed if
containers accessing the volume stop or crash due to an accident.
→ Possible use cases of this option can be backing up databases,
processing logs, performing operations on user data, and so on
Configuring Docker to use a different storage driver
⇒ back up all your images with docker save and stop the docker daemon.
⇒ remove /var/lib/docker. Once you change the storage driver, you can restore the saved
images.
▶ Configuring Docker’s network settings
⇒ Docker creates a separate network stack for each container and a virtual bridge
(docker0) to manage .
→ Network communication within the container, between the container and the
host, and between two containers.
⇒ There are a few network configurations that can be set as arguments to the docker run
command. They are as follows:
→ --dns: A DNS server is what resolves a URL, such as [Link] to the
IP address of the server that is running the website.
→ --dns-search: This allows you to set DNS search servers.
CONTAINER ORCHESTRATION AND CLUSTERING

▶ Container Orchestration Engines (COE) are tools which help in managing many
containers running on multiple hosts.
▶ Introduction to COE
⇒ Containers provide users with an easy way to package and run their applications.
Packaging involves defining the library and tools that are necessary for a user's
application to run. These packages, once converted to images, can be used to create
and run containers.
⇒ These containers can be run anywhere, whether it's on developer laptops, QA
systems, or production machines, without any change in environment. Docker and
other container runtime tools provide the facility to manage the life cycle of such
containers.
▶ ⇒ Using these tools, users can build and manage images, run
containers, delete containers, and perform other container life cycle
operations. But these tools can only manage one container on a
single host. When we deploy our application on multiple containers
and multiple hosts, we need some kind of automation tool. This type
of automation is generally called orchestration.

The primary clustering and orchestration tools available are

Docker-Swarm, Kubernetes.
▶ Orchestration tools provide a number of features, including:
→ Provisioning and managing hosts on which containers will run
→ Pulling the images from the repository and instantiating the containers
→ Managing the life cycle of containers
→ Scheduling containers on hosts based on the host's resource availability
→ Starting a new container when one dies
→ Scaling the containers to match the application's demand
→ Providing networking between containers so that they can access each other on
different hosts
→ Exposing these containers as services so that they can be accessed from
outside
→ Health monitoring of the containers
→ Upgrading the containers
Docker Swarm
▶ Docker Swarm is an orchestration management tool that runs on Docker
applications. It helps end-users in creating and deploying a cluster of Docker
nodes.

▶ Each node of a Docker Swarm is a Docker daemon, and all Docker daemons
interact using the Docker API. Each container within the Swarm can be
deployed and accessed by nodes of the same cluster.
How Does Docker Swarm Work?
▶ In Swarm, containers are launched using services. A service is a group of
containers of the same image that enables the scaling of applications.

▶ There are two types of nodes in Docker Swarm:

▶ Manager node: Maintains cluster management tasks

▶ Worker node: Receives and executes tasks from the manager node
How Does Docker Swarm Work?
▶ The manager node knows the status of the worker nodes in a cluster, and the
worker nodes accept tasks sent from the manager node.

▶ Every worker node has an agent that reports on the state of the node's tasks to
the manager. This way, the manager node can maintain the desired state of the
cluster.

▶ The worker nodes communicate with the manager node using API over HTTP.
In Docker Swarm, services can be deployed and accessed by any node of the
same cluster.
How Does Docker Swarm Work?
The following diagram represents the Docker Swarm architecture:
▶ Features of Docker Swarm
▶ Decentralized access: Swarm makes it very easy for teams to access and
manage the environment
▶ High security: Any communication between the manager and client nodes
within the Swarm is highly secure
▶ Autoload balancing: There is autoload balancing within your environment, and
you can script that into how you write out and structure the Swarm environment
▶ High scalability: Load balancing converts the Swarm environment into a highly
scalable infrastructure
▶ Roll-back a task: Swarm allows you to roll back environments to previous safe
environments
Swarm Mode Key Concepts
Service and Tasks
▶ Docker containers are launched using services.
▶ Services can be deployed in two different ways - global and replicated.
Swarm Mode Key Concepts
▶ Global services are responsible for monitoring containers that want to run on a
Swarm node.

▶ R eplicated services specify the number of identical tasks that a developer

requires on the host machine.

▶ A service is the definition of the tasks to execute on the manager or worker nodes.

▶ When you create a service, you specify which container image to use and which
commands to execute inside running containers.
▶KUBERNETES
⇒ Kubernetes is a container orchestration engine created by Google, designed to
automate the deployment, scaling, and operating of containerized applications.

⇒ It is one of the fastest developing Computer Engineering because it provides a

reliable platform to build distributed applications on a massive scale.

⇒ Kubernetes automates your application, manages its life cycle, and maintains and
tracks resource allocation in a cluster of servers. It can run application containers on
physical or virtual machine clusters.

⇒ It provides a unified API to deploy web applications, databases, and batch jobs.
Features of Kubernetes

It comprises of a rich set of complex features:

→ Auto-scaling

→ Self-healing infrastructure

→ Configuration and updating of batch jobs

→ Service discovery and load balancing

→ Application lifecycle management

→ Quota management
Kubernetes architecture

▶ Kubernetes consists of the following

components from a top-level view:
→ External requests
→ Master node
→ Worker nodes
▶ ⇒The diagram shows the architecture of
Kubernetes: 
External request

⇒ Users interact with Kubernetes cluster through APIs; they explain

what their requirements are and what their application looks like.
Master node
⇒ The master node provides the cluster's control plane. It acts like a controller in
the cluster.

⇒ scheduling, service discovery, load balancing, responding to cluster events, and so

on, are done by components running on the master node only.
 Worker nodes
⇒ The worker nodes run the user's applications and services. There can be one or
more worker node in the cluster. You can add or remove nodes from the cluster to
achieve scalability in the cluster. Worker nodes also run multiple components to
manage applications.
▶ Pod

⇒ smallest deployable unit of computing in Kubernetes.

⇒ group of one or more containers with shared storage or a shared network, and a
specification of how to run the containers.
⇒ If a pod (or the node it executes on) fails, Kubernetes can automatically create a new
replica of that pod to continue operations.
▶ Pod
⇒ Pods have:
▶a unique IP address (which allows them to communicate with each other)
▶persistent storage volumes (as required)
▶configuration information that determine how a container should run.
 ▶ Concepts in Kubernetes
▶ Replica sets and replication controllers
⇒ Replica sets are the next generation of replication controllers.
⇒ A Replica Set's purpose is to maintain a stable set of replica Pods running at any
given time.
⇒ A Replication Controller ensures that a specified number of pod replicas are
running at any one time.
▶ Deployments
⇒ Deployment is high-level abstraction which creates replica sets and
pods. Replica sets maintain the desired number of pods in a running
state.
⇒ Deployment provides an easy way to upgrade, rollback, and scale up
or scale down pods by just changing the deployment specification.
⇒ Secrets ore sensitive information such as usernames, passwords, afer
and more flexible to store such sensitive information in secrets rather
than putting them in pod templates.
⇒ Pods can refer these secrets and use the information inside th
▶ Labels and selectors
⇒ Labels are key value pairs that can be attached to objects, such as pods and even
nodes.
⇒ They are used to organize and select subsets of objects.
⇒ Labels don't provide uniqueness.
⇒ Kubernetes supports two kinds of selectors: equality-based and set-based.
→ Equality-based uses key value pairs to filter based on basic equality or
inequality, whereas set-based are a bit more powerful and allow for the
filtering of keys according to a set of values.
▶ Services
⇒ As pods are short-lived objects in Kubernetes, the IP address assigned to them
can't be relied upon to be stable for a long time. This makes the communication
between pods difficult. Hence, Kubernetes has introduced the concept of a
service.
⇒ A service is an abstraction on top of a number of pods and a policy by which to
access them, typically requiring the running of a proxy for other services to
communicate with it via a virtual IP address.
▶ Volumes
⇒ Volume provides persistent storage to pods or containers. If data is not persisted
on external storage, then once the container crashes, all of its files will be lost.
⇒ Volumes also make data sharing easy between multiple containers inside the pod.
Kubernetes supports many types of volumes, and pods can use any number of
volumes simultaneously.
IMAGES AND CONTAINERS
▶ A Docker image is a collection of all of the files that make up a software application.
→ A Docker image is a file used to execute code in a Docker container.
A Docker image contains application code, libraries, tools, dependencies
and other files needed to make an application run.
→ Each change that is made to the original image is stored in a separate
layer.
▶ A Docker container is a runtime instance of an image. From one image you
can create multiple containers (all running the sample application) on
multiple Docker platform.
▶ A container runs as a discrete process on the host machine.
▶ A base image is the image that is used to create all of your container
images.
⇒ Additional modules can be attached to the base image for deriving the various
images that can exhibit the preferred behavior.
→ Each time you commit to a Docker image you are creating a new layer on
the Docker image, but the original image and each pre-existing layer
remains unchanged.
→ images are typically of the read-only type.
A base image has been illustrated here. Debian is the base image,
and a variety of desired capabilities in the form of functional
modules can be incorporated on the base image for arriving at
multiple images:
⇒ Every image has a unique ID, The base images can be enhanced such that
they can create the parent images, which in turn can be used for creating the
child images.
⇒ The Docker images are the building components of the Docker containers.
⇒ base Docker image represents an operating system, and in the case of Linux,
the base image can be one of its distributions, such as Debian.
▶ A Docker layer
⇒ Docker layer could represent either read-only images or read-
write images. However, the top layer of a container stack is always
the read-write (writable) layer, which hosts a Docker container.
▶ Docker Registry
⇒ A Docker Registry is a place where the Docker images can be stored in
order to be publicly found, accessed, and used .
→ Using the Docker push command, you can dispatch your Docker
image to the Registry so that it is registered and deposited.
→ registry is for registering the Docker images
→ repository is for storing those registered Docker images in a
publicly discoverable and centralized place.
→ A Docker image is stored within a Repository in the Docker
Registry. Each Repository is unique for each user or account.
▶ Docker Repository
⇒ A Docker Repository is a namespace that is used for storing a Docker image.
For instance, if your app is named helloworld and your username or
namespace for the Registry is thedockerbook then, in the Docker Repository,
where this image would be stored in the Docker Registry would be named
thedockerbook/helloworld.
DOCKER
Docker is a tool used to automate the deployment of an application as a lightweight
container so that the application can work efficiently in different environments.
Docker container is a lightweight software package that consists of the dependencies
(code, frameworks, libraries, etc.) required to run an application.
THE DOCKER PLATFORM
⇒ Docker provides the ability to package and run an application in a loosely
isolated environment called a container.
⇒ The isolation and security allow you to run many containers simultaneously on
a given host.
⇒ Containers are lightweight and contain everything needed to run the
application, so you do not need to rely on what is currently installed on the host.
⇒ You can easily share containers while you work and be sure that everyone you
share with gets the same container that works in the same way.
WHAT CAN I USE DOCKER FOR?
Fast, consistent delivery of your applications
⇒ Docker streamlines the development lifecycle by allowing developers
to work in standardized environments using local containers which
provide – your applications and services.
→ Containers are great for continuous integration and continuous
delivery (CI/CD) workflows.
Responsive deployment and scaling
⇒ Docker’s container-based platform allows for highly portable
workloads.
Running more workloads on the same hardware
⇒ Docker is lightweight and fast.
 → It provides a viable, cost-effective alternative to hypervisor-based
virtual machines, so you can use more of your compute capacity to
achieve your business goals.
⇒ Docker is perfect for high density environments and for small and
medium deployments where you need to do more with fewer resources
DOCKER ARCHITECTURE
⇒ Docker uses a client-server architecture.
⇒ The Docker client talks to the Docker daemon, which does the
heavy lifting of building, running, and distributing your Docker
containers.
⇒ The Docker client and daemon can run on the same system, or
you can connect a Docker client to a remote Docker daemon.
→ The Docker client and daemon communicate using a REST
API, over UNIX sockets or a network interface.
DOCKER ARCHITECTURE
Docker Environment and Architecture
▶ There are five critical elements within a doctor Environment/Architecture:
1. Docker container
2. Docker daemon
3. Docker images
4. Docker client
5. Docker registry
▶ The Docker daemon
The Docker daemon (dockerd) listens for Docker API requests and manages
Docker objects such as images, containers, networks, and volumes. A daemon
can also communicate with other daemons to manage Docker services. The
docker daemon is the process that manages containers.
 Docker images
 An image is a read-only template with instructions for creating a Docker
container.
 The default docker images will show all top level images, their repository and
tags, and their size. Docker images have intermediate layers that increase
reusability, decrease disk usage, and speed up docker build by allowing each
step to be cached. These intermediate layers are not shown by default.
 ▶ The Docker container

A container is a runnable instance of an image.

You can create, start, stop, move, or delete a container using the Docker API or CLI.
You can connect a container to one or more networks, attach storage to it, or even
create a new image based on its current state.

The Docker client

The Docker client (docker) is the primary way that many Docker users interact with
Docker. When you use commands such as docker run, the client sends these commands
to dockerd, which carries them out. The docker command uses the Docker API. The
 Docker client can communicate with more than one daemon.

Docker registries

A Docker registry stores Docker images. Docker Hub is a public registry that
anyone can use, and Docker is configured to look for images on Docker Hub by
default. You can even run your own private registry.
CONTAINER VIRTUAL NETWORKING
▶ A Docker container needs a host to run on. This can either be a physical machine or a
VM either On-premises or in the Cloud.
▶ The host has the Docker daemon and client running which enables you to interact with
a Docker registry on the one hand (to pull/push Docker images), and on the other hand,
allows you to start, stop, and inspect containers.
▶ The relationship between a host and containers is 1:N. This means that one host
typically has several containers running on it.
▶ For example, Facebook reports that—depending on how beefy the machine is—it sees on
average some 10 to 40 containers per host running. And here’s another data point: at
Mesosphere, we found in various load tests on bare metal that not more than around 250
containers per host would be possible.
▶ A container network is a form of virtualization similar to virtual machines (VM) in concept

There are four modes available for Docker networking:

bridge mode, host mode, container mode, or no networking.
 Bridge Mode Networking
Bridge Mode Networking
▶ In this mode the Docker daemon creates docker0, a virtual Ethernet bridge
that automatically forwards packets between any other network interfaces
that are attached to it.
Host Mode Networking
▶ This mode effectively disables network isolation of a Docker container.
▶ Because the container shares the networking namespace of the host, it is
directly exposed to the public network;
▶ The container has the same IP address as the host, namely [Link].
▶ When using host mode networking, the container effectively inherits the
IP address from its host. This mode is faster than the bridge mode
(because there is no routing overhead), but it exposes the container
directly to the public network, with all its security implications.
Host Mode Networking
Container Mode Networking

▶ In this mode, you tell Docker to reuse the networking namespace of

another container.

this mode is useful when you want to provide custom network stacks.
No Networking
▶ This mode puts the container inside of its own network stack but
doesn’t configure it. Effectively, this turns off networking and is useful
for two cases: either for containers that don’t need a network (such as
batch jobs writing to a disk volume) or if you want to set up your
custom networking.