1|Page
C2 General
DOCKER FUNDAMENTALS
Why was docker introduced?
- The most common problem that we faced in IT industry was “The code works on my
machine, but it doesn’t work on your machine”. The main reason for this problem
was due to the difference in computer environments. Docker was aimed to solve this
problem.
What is docker?
- Docker is a containerization tool designed to make it easier to create, deploy and run
applications by using containers.
- Docker containers are lightweight alternatives to Virtual Machines and it uses the OS
of the host. It does not have a Kernel of its own.
- There is no need to pre-allocate any RAM in containers.
Difference between Virtualization and Containerization?
Virtualization Containerization
It has an OS of its own. Uses the OS of the host machine.
Starts up slowly Faster startup
Costly Lightweight, and hence cost-effective.
Limited Portability between platforms. Highly portable across different platforms.
Ex – VirtualBox, Hyper-V Ex - Docker
Additionally, I found this article that further elaborates the difference between virtualization
and containerization. Do give it a read.
[Link]
Installing Docker Desktop on your laptop
Step 1: Follow the installation guidelines on this page.
[Link]
Step 2: Below is the snapshot of docker desktop.
2|Page
C2 General
Before we start the practical, there are two concepts that we need to understand –
Containers and Images.
➢ Images – Images are templates/blueprints for containers. It contains the code and
required tools to execute the code. Image is basically a stopped container.
➢ Container – Container is a standardized unit of software that is used to run and
execute the code.
docker run
Image Container
There are two ways to create an image:
• Pull it from Dockerhub (Dockerhub is a cloud-based repository that is used for finding
and sharing the container images).
• Create a dockerfile.
Creating a docker container
Step 1: Log in to the terminal that is inbuilt in Docker Desktop. You can find it in the bottom
right-hand corner.
3|Page
C2 General
Step 2: Once you login to the terminal, run the command docker --version
Step 3: Let’s pull a nginx image from dockerhub.
As you can see, we are able to pull an image from Dockerhub.
Step 4: You can verify the downloaded image by using the command: docker image list
You should be able to see the nginx image. Alternatively, you can check the same in docker
desktop.
4|Page
C2 General
Step 5: Now, let’s try to build container by using the command: docker run -d nginx:latest (d
means detached mode, so that the container processes runs in the background. We can start
the container using the command: docker run nginx:latest as well. But as soon as we exit,
the container would stop.)
Step 6: You can verify the running container by the command: docker ps
Alternatively, you can verify the same in docker desktop as well.
YAYYY!! Now, we have a container with nginx. We can use it to
host websites, reverse proxy-server and so on.
CONGRATULATIONS!!
5|Page
C2 General
Other docker commands:
➢ docker run: To start a new container and interact with it through command line.
[ Ex: docker run hello-world]
➢ docker inspect <container_id>: To view detailed information about a container or
image.
➢ docker port <container_id>: To list the port mappings for a container.
➢ docker stats <container_id>: To view resource usage statistics for one or more
containers.
➢ docker top <container_id>:: To view the processes running inside the container.
➢ docker save: To save an image to a tar archive.
➢ docker load: To load an image from a tar archive.
6|Page
C2 General
➢ docker system prune: To remove all the stopped containers so as to reclaim space.
Before running the command:
After running the command:
➢ docker rmi <image id>: To delete the images.
➢ docker volume ls: To list the volumes in your server.
➢ docker volume inspect <volume_id>: To list the details about the volume.
7|Page
C2 General
➢ docker volume create <volume_name>: To create a volume with the desired name.
Now, let’s understand an important aspect of Docker and that is, Dockerfile.
What is Dockerfile?
- To put it simply, Dockerfile is a text-based document that’s used to create a container
image. It is like a set of instructions for making a container. It tells Docker what base
image to use, what commands to run, and what files to include.
For example, if you are making a container for a website, the Dockerfile might tell
Docker to use an official web server image, copy the files for your website into the
container, and start the web server when the container starts.
Demo Time:
➢ Step 1: Login to your AWS EC2 Instance.
➢ Step 2: Clone in the below repository from github using the below command:
git clone [Link]
➢ Step 3: You should now have a folder with the name “todo-list-app”
➢ Step 4: Create a dockerfile using the command : vim Dockerfile
➢ Step 5: Paste in the below contents:
8|Page
C2 General
You can learn more about these commands at:
[Link]
DIFFERENCE BETWEEN CMD AND ENTRYPOINT:
▪ CMD : Sets default parameters that can be overridden from the Docker
Command Line Interface (CLI) when a container is running.
▪ ENTRYPOINT: Default parameters that cannot be overridden when Docker
Containers run with CLI parameters.
➢ Step 6: Build the image using the below command:
docker build -t todo-app .
➢ Step 7: Run the container using the below command:
docker run -d -p 3000:3000 todo-app
➢ Step 8: Since this application runs on port 3000, you need to add this port to the
inbound rules of your security group.
9|Page
C2 General
Then click on Save rules.
➢ Step 9: To verify if the application is running fine, copy the public IP of your AWS EC2
Instance, and paste it on any browser using the below command:
[Link]
➢ Step 10: Now, you have a running application that is hosted on a docker container.
Amazing right?
Docker Volume:
Let’s try to understand this concept with an example.
Step 1: Create a container of mysql by running the below command:
docker run -d -e MYSQL_ROOT_PASSWORD=root mysql:latest
Note: You need to specify an environmental variable, otherwise the container with exit with
the below error
Step 2: To enter inside the docker container, run the below command:
docker exec -it <container_id> bash
Step 3: To login into mysql, enter the below command.
10 | P a g e
C2 General
mysql -u root -p
You’ll get a prompt to enter the password. You need to enter root here.
Step 4: Create a database and a table by using the below commands.
To get the list of databases in mysql:
show databases;
To create a database:
create database kyc_database;
To use the created database:
use kyc_database;
To create a table inside the database:
11 | P a g e
C2 General
CREATE TABLE messages (
id INT AUTO_INCREMENT PRIMARY KEY,
message TEXT
);
To insert data in the table:
insert into messages (message) values (“kyc stored”); -- Run this query multiple times to
create entry inside the table.
To list the entries of the table:
select * from messages;
Step 5: Now, let’s stop and remove the container by running the below command.
docker stop <container_id> && docker rm <container_id>
Step 6: Now let’s launch a container again by running the command.
docker run -d -e MYSQL_ROOT_PASSWORD=root mysql:latest
Step 7: Now, let try to see if the database we created exists or not.
12 | P a g e
C2 General
OH SNAP!! Our database is gone. What do we do now? This can be prevented by a
concept known as Docker Volume. Below is the definition:
- A Docker volume is a persistent data store for containers, created and managed by
Docker. Volumes are used to store data outside the container's writable layer,
ensuring that the data is not lost when the container is removed or recreated. This
makes volumes a preferred mechanism for persisting data generated by and used by
Docker containers. Volumes are always mounted on the Host machine.
Step 8: Now, let’s create a backup directory in our Host OS.
mkdir mysql-backup
Step 9: Remove the previously created container and re-launch the container, but this time
with a different command.
docker run -d -v /home/ubuntu/mysql-backup:/var/lib/mysql --name mysql -e
MYSQL_ROOT_PASSWORD=root mysql:latest
13 | P a g e
C2 General
Note: The part before the colon (:) is the path of your host OS and the part after the colon
is the path of your docker container. Also, /var/lib/mysql is the default path for mysql.
Step 10: Repeat the above steps of creating database and table.
Step 11: Let’s remove the container now and verify the contents in the path:
/home/ubuntu/mysql-backup in your Host OS.
BOOM!! Now, you should be able to see some contents in this path including the
kyc_database that you have created.
Step 12: Now, let’s remove the container again and re-launch it with the below command:
14 | P a g e
C2 General
docker run -d -v /home/ubuntu/mysql-backup:/var/lib/mysql --name mysql -e
MYSQL_ROOT_PASSWORD=root mysql:latest
Now, you should be able to see the kyc_database as well. Everything in intact!!
Friends, that is the concept of Docker Volumes. Do give it a thumbs
up, if you have liked it.
15 | P a g e
C2 General
Docker Networking:
Docker Networking refers to the ability for containers to connect to and communicate with
each other, or to non-Docker workloads.
The following network drivers are available by default, and provide core networking
functionality:
▪ Bridge – The default network driver.
▪ User-defined bridge – One that we can create externally to connect the dockers.
▪ Host – Remove network isolation between the container and docker host.
▪ Overlay – Overlay network connect multiple Docker daemons together.
▪ MacVLan – Assign a MAC Address to a container.
▪ IPVLan – Provide full control over both IPv4 and IPv6 addressing.
▪ None – Completely isolate a container from the host and other containers.
Demo Time:
Step 1: Clone the repository using the below command:
git clone [Link]
Step 2: Go through the Dockerfile in this repository and create an image named “flaskapp”
by running the below command:
docker build -t flaskapp .
Step 3: Create mysql container by running the below command:
docker run -d --name mysql -e MYSQL_DATABASE=mydb -e MYSQL_ROOT_PASSWORD=admin -v
mysql-data:/var/lib/mysql -p 3306:3306 mysql:5.7
Your mysql container should be up and running.
Step 4: Now, let’s create flaskapp container from the image that we created previously.
However, we need to pass certain MYSQL environment variables. The instruction are
specified in the [Link] file located in : [Link]
tier-flask-app/blob/master/[Link]
docker run -d --name flaskapp -e MYSQL_HOST=mysql -e MYSQL_USER=root -e
MYSQL_PASSWORD=admin -e MYSQL_DB=mysql -p 5000:5000 flaskapp:latest
Step 5: However, the container is in Exited mode.
16 | P a g e
C2 General
You can now check the logs for the container to see what went wrong, by running the
command : docker logs <container_id>
If you see, the container has not been able to establish a connection with the MySQL
container that we have created previously. Now, let’s try to analyse the reason by inspecting
the below two containers by using the command: docker inspect <container_id>
The above snapshot is for the flaskapp container. If you see nothing is configured for this
container. There are no endpoints or other parameters. Now, it is understandable that the
above 2 containers have a bridge of its own. To solve this issue, we need to create common
bridge so as to connect the two containers.
Step 6: Create a network by running the command.
17 | P a g e
C2 General
docker network create -d bridge <name_of_network>
Step 7: Inspect the network that we created
If you see, there are no containers.
Step 8: Remove the previously created containers by running the command:
docker stop <container_id> && docker rm <container_id>
Step 9: Now, let’s relaunch the container but this time we need to pass a flag --
network=twotier for both the containers. The command is:
docker run -d --name mysql -e MYSQL_DATABASE=mydb -e
MYSQL_ROOT_PASSWORD=admin -v mysql-data:/var/lib/mysql -p 3306:3306 --
network=twotier mysql:5.7
18 | P a g e
C2 General
If you inspect the twotier network now, you should be able to see one container.
Step 10: Do the same for the flaskapp container and inspect the network. The command is:
docker run -d --name flaskapp -e MYSQL_HOST=mysql -e MYSQL_USER=root -e
MYSQL_PASSWORD=admin -e MYSQL_DB=mysql -p 5000:5000 –network=twotier
flaskapp:latest
19 | P a g e
C2 General
If you notice, there are two containers in the “Containers” tag.
Step 11: Now, that two containers are running.
Reason: Because, both these containers are in the same network.
Step 12: Now, let’s try to see if our application is working. For that, we need to add port
5000 to the Inbound rules of our security group of the EC2 instance.
Click on “Save rules” and launch the container in your browser by running :
[Link]
BOOOOOOOMMM!! You, should be able to see the application running.
20 | P a g e
C2 General
Type some messages and verify the same in your mysql container. The messages would be
stored in the tables.
Docker Compose:
Docker compose is a utility that allows you to create and manage multiple docker containers
at once.
Demo Time:
Step 1: Create a file with the name [Link]
Now, what is the advantage of docker-compose?
- Previously, we had to run the command docker run and docker build command
multiple times after we made changes to Dockerfile or after doing any other changes.
- Using docker compose, we kind of automate the docker start and stop process.
Step 2: Paste in the below contents to this file.
21 | P a g e
C2 General
version: "3.8"
services:
mysql:
image: mysql:5.7
container_name: mysql
restart: always
environment:
MYSQL_ROOT_PASSWORD: admin
MYSQL_DATABASE: mydb
volumes:
- mysql-data:/var/lib/mysql
networks:
- twotier
ports:
- 3306:3306
healthcheck:
test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-uroot", "-padmin"]
interval: 10s
timeout: 20s
retries: 10
start_period: 60s
flask-app:
build:
context: .
container_name: flask-app
restart: always
environment:
MYSQL_HOST: mysql
MYSQL_USER: root
MYSQL_PASSWORD: admin
MYSQL_DB: mydb
networks:
- twotier
ports:
- 5000:5000
depends_on:
- mysql
healthcheck:
test: ["CMD-SHELL", "curl -f [Link]
interval: 10s
timeout: 20s
retries: 10
start_period: 60s
volumes:
mysql-data:
22 | P a g e
networks:
twotier:
C2 General
Step 3: Install docker compose in your EC2 Instance by running the below command.
apt-get install docker-compose-v2
Step 4: Validate the contents of [Link] by running the below command:
If you get any errors, resolve it accordingly.
Step 5: Start docker compose by running the command:
docker compose up -d (To run the app in detached (background) mode).
Step 6: Now check, if the application is up by running the command:
[Link]
23 | P a g e
C2 General
24 | P a g e
C2 General
Multi Stage Build in Docker:
- Multi-stage builds are useful to anyone who has struggled to optimize Dockerfiles
while keeping them easy to read and maintain.
- With multi-stage builds, you use multiple FROM statements in your Dockerfile. Each
FROM instruction can use a different base image, and each of them begins a new
stage of build. You can selectively copy artifacts from one stage to another, leaving
behind everything you don’t want in the final image.
- The end result is a tiny production image with nothing but the binary inside. None of
the build tools required to build the application are included in the resulting image.
NOW, LET’S TRY TO UNDERSTAND THIS WITH A DEMO!
Step 1: Firstly, let create a Dockerfile with the image python:3.9 and check the size of the
image. Below are the contents of the Dockerfile.
Step 2: We will now create an image from the Dockerfile and check the size. The command
is: docker build -t flask-app-full .
As can be seen, the size of the image is 1.07 GB, which is quite big.
Step 3: To optimize the size of the image, we will now create a multi-stage docker file. Below
is an example for the same.
25 | P a g e
C2 General
We name this Dockerfile as - Dockerfile-multi-stage. Now, let us understand the concepts.
➢ As we see, there are two sections in this file. In the first section, the FROM
instruction uses a bigger base image and is used to install the libraries and app
dependencies (Building the binary)
➢ In the second section, the FROM instruction uses a smaller base image and installs
the runtime dependencies. The second FROM starts a new build stage with a
comparatively smaller python image as its base.
➢ The COPY command just copies the build artifact (caches) from the previous stage
into this new stage.
Step 4: Now, let’s build an image with this newly created multi-stage dockerfile. The
command to create an image with a file named other than Dockerfile is:
docker build -t flask-app-multi-stage -f dockerfile-multi-stage .
Step 5: Verify the size of this image.
26 | P a g e
C2 General
If you see, this image is smaller in size compared to the previously created image. This
shows, how we can optimize the size of the image.
To conclude, below are some of the advantages of using a multi-stage build:
• Optimizes the overall size of the Docker image.
• Removes the burden of creating multiple Dockerfiles for different stages.
• Easy to debug a particular build stage.
• Able to use the previous stage as a new stage in the new environment.
• Ability to use the cached images to make the overall process quicker.
• Reduces the risk of vulnerabilities found as the image size is smaller with the multi-
stage builds.
(Source: [Link]
Docker Scout:
Docker Scout is a solution for proactively enhancing your software supply chain security. By
analysing your images, Docker Scout compiles an inventory of components, also known as a
Software Bill of Materials (SBOM). The SBOM is matched against a continuously updated
vulnerability database to pinpoint security weaknesses. (Source:
[Link] )
Commands:
docker scout cves <image-name> - Gives a detailed view of all the vulnerabilities for your
image.
To increase the volume size of EC2 Instance:
As the EC2 instance, that we use is in free-tier, at times we face the issue “No space available
on device”. To solve this problem, we can increase the size of the volume that is attached to
the EC2 Instance. To do this, we follow the below steps:
1. Navigate to the “Storage” section of your EC2 Instance and click on the volume.
27 | P a g e
C2 General
2. Select the volume and click on “Actions”. There, you will get an option to “Modify
volume”.
3. Edit the volume as per your need. It will take some time to initialize the volume. Wait
until the Volume state is “In-use”
4. Now, go to your EC2 instance and run the command: sudo apt install cloud-guest-
utils
5. If you run the command “lsblk”, you ll see that the volume is available but not
attached.
6. To grow the partition, run the command : sudo growpart /dev/xvda 1
28 | P a g e
C2 General
7. To attach the volume to the root(/) mountpoint, run the command: sudo resize2fs
/dev/xvda1
8. Now, if you run df -h, you should be able to see that the total size of the root
mountpoint has increased.
29 | P a g e
C2 General