Background
Why
Docker has quite an amount of buzz around it today because it makes so many things easy that were difficult with virtual machines.
Docker containers makes it easy for Developers, Systems Administrators, Architects, Consultants and others to quickly test a piece of software in a container; much quicker than a virtual machine, and using less resources. The average command in Docker takes under a second to complete.
[root@keith]# time docker run fedora cat /etc/redhat-release Fedora release 20 (Heisenbug) real 0m0.715s user 0m0.004s sys 0m0.004s
What
Simple Use Cases
- I need to see the man page from a specific version of RHEL, CentOS or Fedora
- I need to quickly verify the command line options of a program
- I need to test the functionality of a specific version of software
- I need a scratch pad that is NOT my system
- I need a single daemon running, and I don't care what distribution of Linux it runs on (see registry below)
Complex Use Cases
Docker containers run a single process when started, but complex installations of software which require multiple daemons running simultaneously (RHEV-M, Satellite, etc) can be done. However, they require more engineering work using either Bash scripting or running SystemD in the container.
Production vs. Development
The Docker tooling reached 1.0 in June, 2014 and with some precautions, can be used in production. There is a lot to think about with a production deployment, and I suggest readying the Architecting Containers series if you are seriously considering a production deployment.
CentOS and Red Hat Enterprise Linux
This tutorial will focus on integration with Red Hat technologies including CentOS and Red Hat Enterprise Linux. The Docker tooling (daemon and client) is available in Red Hat Enterprise Linux, CentOS, and Fedora. Also, base Docker images are available for Red Hat Enterprise Linux (6 and 7), CentOS and Fedora.
Architecture
One of the key advantages of using Docker is it's centralized image management server, called a Registry Server. The Docker project maintains a public registry server which hosts images they maintain, as well as images created by the community. This registry service is free to use, as long as the images are public.
As one builds images, they are made up of layers. These layers are shared together in, what is called a repository. Users on the registry can share multiple repositories.
Docker has official CentOS and Fedora repositories which they support:
This tutorial will use public CentOS Fedora repositories, but you may also run through this tutorial using Red Hat Enterprise Linux:
OS Virtualization vs. Application Virtualization
Why separate RPMs for each major version of Red Hat Enterprise Linux or CentOS into different YUM repositories? This was a conscious decision because we are working with a full enterprise Linux distribution versus a single application. Historically, it has been best practice to install a fresh copy when upgrading major versions of Red Hat Enterprise Linux or CentOS. While it is possible to upgrade in place and share multiple versions in a single repository, this is not the preferred method with an enterprise operating system.
However, when virtualizing individual applications, it may be very appropriate to upgrade in place and share all versions within a single repository (See section: Set Up a Registry Server). Each version will be tagged in place and it's easy to upgrade or downgrade atomically.
Registry Servers
After reading this tutorial, you may be excited to set up your own registry server. This is easy to do, but has some caveats, so think through whether it is worth just using a hosted registry server. If you want to deploy an onsite registry server, there are several options:
- Integrated OpenShiftRegistry Server: The OpenShift integrated registry provides authentication and tight integration with OpenShift, but can also be used as a stand alone registry server.
- Atomic Registry: This is the same registry server provided in OpenShift
- Red Hat Satellite with Docker Plugin: Provides Docker compatible repository management. Has the ability to authenticate who can save image layers, and do version control.
- docker-distribution.x86_64: Docker toolset to pack, ship, store, and deliver content. An RPM for this package is included in RHEL7.
- docker-registry.x86_64: Registry server for Docker. An RPM for this package is included in RHEL7.
Basic Operations
Now we will run through some basic operations to get you up and running.
Install Docker
In CentOS 7, this requires the user space tools and daemon to be installed from an RPM. On Red Hat Enterprise Linux, this RPM is contained in the rhel-7-server-extras-rpms/x86_64 channel.
yum install docker systemctl enable docker.service systemctl start docker.service
Test Docker
This will automatically pull the latest CentOS 4 image from the remote repository and cache it locally.
docker run -it centos cat /etc/redhat-release
Pull an Image
This will pull the latest CentOS 5 image from the remote repository and cache it in the local index. If the image you are pulling is made up of layers, all of the layers will be pulled.
docker pull centos
List Images
This will list all of the images in the local index and display how they are linked to each other. Every time a new container is spawned from an image, it will create another copy on write image to save it's changes too. The tree structure will help make things clear.
Since, Docker 1.7, there is no native tooling to inspect image layers in a local cache, but with the help of a tool called dockviz, you can quickly inspect all of the layers in a local repository. The following command will returned shortened versions of the UUID that are typically unique enough to work with on a single machine. If you need to the full UUID, use the --no-trunc option.
docker run --rm --privileged -v /var/run/docker.sock:/var/run/docker.sock nate/dockviz images -t
Tag an Image
It makes it easier to deal with images if they are tagged with simple names.
docker tag fatherlinux/centos5-base centos5-base
Run a Container
Notice how easy it is to test a command in CentOS 4
docker run -i -t -rm centos man rsync
Log in to the Hosted Docker Registry
To create repositories on the public Docker Registry, it is necessary to sign up at:
https://www.docker.io/account/signup/
Once you have created an account, you will need to login from the command line
docker login index.docker.io
If login is successful.
Username: fatherlinux Password: Email: smccarty@redhat.com Login Succeeded
Dockerfile: Commit an Image
Once logged in to the public Docker Registry, new images can be built and committed with code using a Dockerfile. This allows an administrator to automatically rebuild a known good starting point quickly and easily. It is recommended to always start with an image defined by a Dockerfile.
There are a couple of important things to notice with this Dockerfile. First, the FROM directive specifies centos as the base image. This will pull the latest image from the centos repostiory on DockerHub. In this example, I have provided the source repository for you. Second, the only change we have specified in the Dockerfile, is to update CentOS to latest available packages. Finally, notice we have a commented out ENTRYPOINT at the end of the file. Play with this option to get a feel for it while building from this Dockerfile.
vi Dockerfile
# # Version 1 # Pull from CentOS RPM Build Image FROM centos MAINTAINER Scott McCarty smccarty@redhat.com # Update the image RUN yum update -y # Output # ENTRYPOINT tail /var/log/yum.log
Build and tag the image
Execute the following command in same directory as the Dockerfile.
docker build -t centos-updated .
Inspect the new image
This will list all of the layers in an image
docker run --rm --privileged -v /var/run/docker.sock:/var/run/docker.sock nate/dockviz images -t
└─60e65a8e4030 Virtual Size: 196.6 MB Tags: docker.io/centos:latest
└─6d8919b62698 Virtual Size: 196.6 MB
└─05192ebc2b2d Virtual Size: 264.0 MB Tags: centos-updated:latest
Notice that the new image is now available for deployment.
Test the new image
docker run -it --rm centos-updated tail /var/log/yum.log
Jan 13 09:57:25 Updated: nss-sysinit-3.19.1-19.el7_2.x86_64 Jan 13 09:57:26 Updated: nss-3.19.1-19.el7_2.x86_64 Jan 13 09:57:27 Updated: nss-tools-3.19.1-19.el7_2.x86_64 Jan 13 09:57:28 Updated: 1:openssl-libs-1.0.1e-51.el7_2.2.x86_64
Manually: Commit an Image
Once a container has changes made locally, they can be committed to the local index. This allows you to check point and continue. It also allows you to create new images based off of this modified container.
docker run -it centos bash
Modify the image
Make some changes inside the container. In this example, create a test file and exit
echo test file > /etc/test.cfg
exit
Commit the container
First, get a list of containers. Notice that every container has a CONTAINTER ID and a STATUS. A status of Up means the container is currently running, while a status of Exit indicates that the container has been stopped. Think of the CONTAINER ID as a branch from the base image that contains all of the changes that were made to the container while it was running. By default this data is saved even after the container is shut down.
docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES c65fe9f4194b centos "bash" About a minute ago Exited (0) 3 seconds ago condescending_galileo 620e24fc14c2 centos-updated "tail /var/log/yum.lo" 6 minutes ago Exited (0) 6 minutes ago determined_perlman ...
Now, commit the container back as a branch of it's base image
docker commit c65fe9f4194b
Notice that the image is now available in the tree output. Also, notice that the newly created image layer (6d8919b62698) is a branch of the root centos:latest image, not the centos-updated:latest image, which we previously built with a Dockerfile.
docker run --rm --privileged -v /var/run/docker.sock:/var/run/docker.sock nate/dockviz images -t
└─60e65a8e4030 Virtual Size: 196.6 MB Tags: docker.io/centos:latest
├─5b6001fad9a6 Virtual Size: 196.6 MB
└─6d8919b62698 Virtual Size: 196.6 MB
└─05192ebc2b2d Virtual Size: 264.0 MB Tags: centos-updated:latest
Tag the new image with something meaningful
docker tag 5b6001fad9a6 centos-test
Push a Container
Once a container is committed locally, it can be pushed back to the registry server to be shared. The changes will be pushed as a layered image. Notice how quickly it is able to push only the differences between your modified image and the base image. This is a big part of the value.
docker tag centos-test fatherlinux/centos-test docker push fatherlinux/centos-test
The push refers to a repository [fatherlinux/centos-test] (len: 1)
Sending image list
Pushing repository fatherlinux/centos-test (1 tags)
e39724bc32b2: Image already pushed, skipping
c9bfb69481a8: Image successfully pushed
Pushing tag for rev [c9bfb69481a8] on {https://registry-1.docker.io/v1/repositories/fatherlinux/centos6-base-hostname/tags/latest}
Advanced Operations
Pull All Standard Images
These repositories (images) are publicly available from DockerHub and the Red Hat Registry.
docker pull centos docker pull fedora docker pull registry.access.redhat.com/rhel
Create Base Image
This method was developed with guidance from this script. This example is based on CentOS 6.
Create a tar file of the system
tar --numeric-owner --exclude=/proc --exclude=/sys -cvf centos6-base.tar /
Copy the tar file to where the consuming system and Import the image
cat centos6-base.tar | docker import - centos6-base
Test
docker run -i -t centos6-base cat /etc/redhat-release
Set Up a Registry Server
Notice that the entire application is packaged up and ran from inside of a docker container. This has the interesting consequence that we are not even concerned with what operating system is hosting this registry application. Also, notice that port 5000 in the docker container is mapped to port 5000 on the hosting virtual machine, which makes the application running in the container transparently appear to be running on the virtual machine.
docker run -p 5000:5000 registry
Search Private Registry
List all images in the repository
http://registry.example.com:5000/v1/search?
Search for all repositories with the word "rhel" in their name
http://registry.example.com:5000/v1/search?q=rhel
Remove Old Docker Containers
By default, Docker keeps changes for every container which is instantiated. When testing, this can be undesirable. Be careful because this will remove all branches/data. Any containers which have not been committed will have all data deleted:
docker rm `docker ps --no-trunc -a -q`
