Month: March 2021

Docker –link containers

Docker link is actually labeled dec, but there are still some traditional applications using it

The most typical is linking web applications and databases

For example, you can start a WordPress

docker run --name wp_mysql -p 3306:3306 -v /data/mysql:/var/lib/mysql -e MYSQL_ROOT_PASSWORD=123 -d mysql:5.7

docker run --name wp_web --link wp_mysql:mysql -v /data/wordpress:/var/www/html -p 80:80 -p 443:443 -d wordpress:5.6.0

WordPress docker deployment using – link can directly connect to the database without configuring MySQL database connection.

Here I want to discuss what link has done

First of all, we need to clarify two concepts: MySQL is the source container and the connected container, WordPress is the target container and the receiving container

For the next test, we start two busybox containers and connect them together

docker run -i -t --name source -p 3001:3001 -p 3002:3002 -e source_env_1=123 -e source_env_2=456 busybox sleep infinity
docker run -i -t --name target -p 3003:3003 -p 3004:3004 -e target_env_1=123 -e target_env_2=456 --link source:mysource busybox sleep infinity

1. alias

–link wp_mysql:mysql

For WordPress containers, WP_ MySQL and MySQL are a container with the same containerid

–link source:mysource

For the target container, source and mysource are one container

2. DNS

3. environment variable

The reason why WordPress can directly connect to the database above is that it actually uses environment variables

The image of WordPress will read the database configuration from the alias MySQL by default, so if it is written as –link wp_mysql:test_mysql and WordPress can’t recognize the database, which can be understood as a convention

The target container gets the following environment variables

4. If the IP of the source container changes

After deleting the source container, I create an nginx container, which takes up all the resources of the original source container

172.17.0.2 IP you can see that the new IP is 172.17.0.4

At this point, no content is updated in the target container

Start a target2 container, and you can see that DNS and env are replaced with new ones

Docker Volume

For data that needs to be persisted outside the container, you need to use mount

Early dockers could only mount the local disk path, which is the first way below

The first way is to mount the local path directly

docker run -d -it --name=nginx1 -p 8001:80 -v ~/tmp:/usr/share/nginx/html nginx

In this way, the docker will not cover any file contents in the local path

In other words, if there are no files in the local path TMP, then after mounting, the container will not have any files in the mounted path

This is a way to use local content to override the content of the container’s corresponding path

The second way is to create a volume managed by docker

docker volume create tmpvol
docker run -d -it --name=nginx2 -p 8002:80 -v tmpvol:/usr/share/nginx/html nginx

The convenience of this method is that it can persist the data and continue to use the contents of the container

This is a way to store the container content to the specified volume

On Linux, it’s very easy to access this path directly from the host

The path is

On MacOS, it is more complex, because the docker desktop of MacOS is also based on virtual machine

After the old version of docker desktop is attached to TTY with the following command, you can access the above path similar to Linux

screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty

However, in version 3.1.0, I didn’t find this TTY file

In fact, this operation has become simpler than before

Notice the CLI icon in the upper right corner?

But this method is not on the host, but provided by docker exec

Start and Stop Container

Generally, service processes such as apache2, Tomcat and MySQL will not stop directly, so docker run and docker start will not exit directly in this case

docker run -i -t –name nginx nginx

The -i -t parameter is fundamental to providing an interactive shell

• -i ensures that stdin in the container is open and can be attached with docker attach
• -t assigns a pseudo TTY terminal to the created container so that the newly created container can provide an interactive shell

If you want to interfere with the process in Linux system, you need to send some specific signals

There are dozens of these signals, so we won’t list them one by one

There are three common ways to stop or terminate a process,

• CTRL + C sends SIGINT signal, which will and will only send to the process in the currently active window and all the subprocesses of the process (process tree)
• Kill PID sends SIGTERM, which can be blocked, processed, and ignored
• Kill – 9 PID sends sigkill. Sigkill signal cannot be blocked, processed, or ignored. It stops the specified process directly and does not affect other child processes and parent processes. However, the parent process of the child process will be changed from the process that was killed to the init process

SIGTERM and SIGINT signals will be processed according to the logic defined by the program, such as the following Java program

import sun.misc.Signal;
import sun.misc.SignalHandler;
 
@SuppressWarnings("restriction")
public class Test {
 
 public static void main(String[] args) {
  System.out.println("Signal handling example.");
  SignalHandler handler = new MySignalHandler();
  // kill命令
  Signal termSignal = new Signal("TERM");
  Signal.handle(termSignal, handler);
  // ctrl+c命令
  Signal intSignal = new Signal("INT");
  Signal.handle(intSignal, handler);
  try {
   Thread.sleep(50000);
  } catch (InterruptedException e) {
   System.out.println("Interrupted: " + e.getMessage());
  }
 }
}
 
@SuppressWarnings("restriction")
class MySignalHandler implements SignalHandler {
 
 @Override
 public void handle(Signal signal) {
  System.out.println("Signal handler called for signal " + signal);
  try {
   System.out.println("Handling " + signal.getName());
  } catch (Exception e) {
   System.out.println("handle|Signal handler" + "failed, reason "
     + e.getMessage());
   e.printStackTrace();
  }
 }
 
}

When using Ctrl + C to send SIGINT signal to it, it just outputs information and does not stop itself

After using kill PID to send SIGTERM signal, it only outputs information and does not stop itself

Finally, the sigkill signal of kill – 9 PID directly kills the system

To stop a container, the most common method is docker stop

The stop command essentially sends SIGTERM signal to the process (such as nginx process). Most applications can correctly respond to this signal and start to stop themselves

If there is a special case, you need to use docker kill container_ Name to send sigkill

How to create the smallest docker image

About the smallest image

The smallest image can be pulled is alpine

Alpine Linux is a Linux distribution based on busybox and Musl Libc. Its biggest advantage is its small size. When I write this article, the latest version is 3.12.4, with a size of only 2.67M

https://hub.docker.com/_/alpine

Alpine has developed a lot of community versions, basically aiming at small

• docker pull alpine/git 11.39M
• docker pull alpine/socat 3.22M
• docker pull python:rc-alpine 16.54M

In fact, alpine is not the smallest image. There is also an empty image called scratch

Scratch doesn’t even provide the most basic / bin, / usr, / lib, / dev

Through the go language to write a HelloWorld and the code compiled into binary format, directly use the

CMD “./hello”

The following error will be reported because the scratch image does not even provide the most basic sh

In this case, some changes to the format of the CMD are required

FROM library/golang:alpine as base
COPY hello.go /hello.go
WORKDIR /
RUN go build /hello.go

FROM scratch
COPY --from=base /hello /hello
CMD [ "/hello" ]

The mirror constructed in this way is only 1.94mb

Docker Image

Docker’s mirror looks more like a class from an object-oriented perspective, while a container is an object created from it

Docker Ecosphere has a large number of mirror warehouses, of course the most well-known are Https://hub.docker.com/

We know that docker images are layered, such as the following Nginx mirrors

As we mentioned in the Difference between Docker and Virtual Machine, containers override the rootfs layer of the Linux host

Build virtual Ubuntu, CentOS, Busybox, CoreOS and other environments on top of the host machine

The principle used is copy-on-write.

Container layers are called writable layers and below them are called mirror layers

All changes to the container, whether added, read-written, or deleted, will only occur in the container layer. Only the container layer is writable and the mirror layer beneath the container layer is read-only.

• Write and delete operations directly at the container layer
• During a read operation, the docker looks for the file from top to next and reads it directly as soon as it is found

Difference between Docker and Virtual Machine

docker容器和虚拟机的共同点在于，都可以在宿主机上提供 虚拟化 环境，各个虚拟环境是相互隔离的

The same between docker and virtual machine is they both can provide isolated environment

它们的主要区别在于

虚拟机是base在硬件层上的，也就是硬件级别的虚拟化，虚拟机有独立的虚拟硬件，独立的虚拟bios，独立的虚拟驱动

而docker base在rootfs层上的

At the bottom of the Linux system is the system kernel, and a typical Linux boot requires two File systems

• bootfs
• rootfs

Bootfs (boot file system) mainly contains bootloader and kernel. bootloader mainly boots the kernel. bootfs are umount after boot is successful and the kernel is loaded into memory

rootfs (root file system) 包含的就是典型 Linux 系统中的 /dev, /proc, /bin, /etc 等标准目录和文件。

So bootfs are basically the same for different Linux distributions, and rootfs are different, so different distributions can share bootfs 

If your application requires a specific system kernel, such as Linux Kernel 2.6 only, then the docker is not appropriate for this application and you should choose a virtual machine scenario

Most applications are not kernel dependent

Why we need docker

Back in 2013, I used containers as virtual machines

Until 2021, many people are still used to using the Ubuntu or CentOS container as a virtual machine, starting the process by /bin/bash

In fact, this is not appropriate

Compared with the virtual machine, the container is actually more similar to the program installation package of windows and the rpm and dpkg installation packages of Linux, but not exactly the same

The goal of the installation package is to let users “install and run an application in the simplest way”

Usually, the installation package will copy files and set some related configurations. Some of them need to be compiled locally and then set environment variables. However, the installation has one disadvantage. If you install Python 2 and then install Python 3, it may bring some environment conflicts such as dependency libraries

In fact, docker provides the ability to install and deploy applications with one click, similar to the installation package. At the same time, it also provides environment isolation (even network isolation, etc.) similar to conda

Before docker, if you need to deploy the developed application to the user’s server, you may need to

• Copy file
• Set config file
• Check the environment variables of the server
• If the production and development environments are inconsistent, you may need to compile
• Configure dependent Libraries
• Install the required database

After the appearance of docker, you only need to create the corresponding container with image to obtain all environment variables and environment dependencies, which was unimaginable before, such as starting a standard MySQL service

docker run -itd --name mysql-test -p 3306:3306 -e MYSQL_ROOT_PASSWORD=123456 mysql

In addition to being able to quickly publish to the production environment, this quick start advantage of docker can also be applied to many POC scenarios, fast testing of various versions, throughput, stability and compatibility testing can be implemented based on docker

Before docker appeared, there was another option to quickly distribute the development environment of dev through the virtual box based on vagrant. In fact, this practice is somewhat similar to the concept of “Infrastructure as Code”. Vagrantfile is used to define the required configuration, and the box file of the virtual box is used to distribute the local development environment

But VirtualBox is a virtual machine in essence. There is a big difference between virtual machine and docker

What exactly container is

You must head that before

“Software is eating the world, container is eating the software”

Especially today, Devops and public cloud are so popular, almost every team is using containers, and everyone is talking about docker

Containers are more than dockers

Container is a set of specifications developed by open container Initiative (OCI)

https://opencontainers.org/

Includes runtime spec and image format spec

OCI includes the following companies

The common container runtime mainly includes

Lxc is a more traditional runtime on Linux, and docker used Lxc at the beginning

Runc is the default runtime of docker now

rkt is the runtime provided by coreos

In 2020, some news mentioned that “Kubernetes will no longer use docker”. In fact, the exact meaning is that Kubernetes can use other container runtimes in the future, rather than only support docker runtime

Install Docker

There are so many ways can install docker

apt、snap、yum etc…

However the easist way is from the rancher team, with the best compatibility whatever you are using centos or ubuntu

below are the samples of 19.03 and 20.10

sudo curl https://releases.rancher.com/install-docker/19.03.sh | sh
sudo curl https://releases.rancher.com/install-docker/20.10.sh | sh