Web Application Containers and Deployment

Problem

• In a typical web application running on a server, numerous dependencies, such as application code, libraries, interpreters, and operating system settings, need to be present and configured correctly.
• Complexities arise as different web applications can have incompatible dependencies, leading to inefficient resource allocation and limited sharing between systems.

Containers

• Introducing container images simplify the deployment of web applications by packaging an application and its prerequisites into a portable file.
• Examples of container management tools include Docker, rkt, and systemd-nspawn.
• Containers work by leveraging kernel features such as namespaces, control groups (cgroups), capabilities, and secure computing mode (seccomp) to isolate and manage processes.
• Each container utilizes its own private root filesystem and operates in a restricted process namespace, ensuring that applications within containers cannot access files or resources outside their container environment.

Kernel support

• Containers rely on kernel features to ensure isolation and security:
  • Namespaces: Used to isolate resources like process IDs, network interfaces, and user IDs.
  • Control groups (cgroups): Prevent containers from consuming excessive system resources like CPU and memory.
  • Capabilities: Allow processes to execute specific, restricted kernel operations.
  • Secure computing mode (seccomp): Provide fine-grained control over system calls that containers can make.

Images

• A container image acts as a template for creating containers.
• These images utilize a union filesystem, allowing the container to work with a layered filesystem.
• The layout of binaries, libraries, and supporting files within a container image conforms to standard Linux filesystem hierarchy specifications.
• During container creation, the Docker engine combines a read-only image with a writable layer, enabling containers to modify files and store changes transparently.
• This layered filesystem approach allows for efficiency in storage usage as multiple containers can share immutable base layers, reducing startup times.

Networking

• Containers connect to the network through a combination of network namespaces and a bridge network within the host.
• Containers have private IP addresses within the host, which are not reachable from outside the host.

Docker

• An open-source container engine that includes the docker command-line interface for managing tasks related to container operations.
• The dockerd daemon provides persistent system-level processes to manage container and image operations.
• When dockerd runs a container, it creates a writable filesystem layer separate from the source container image.
• Containers can still access files and metadata from the image, but writes are confined to their individual namespaces.

The container experience

• Downloading Images:
  • The docker pull command downloads images from Docker Hub.
  • Example: docker pull ubuntu:latest
• Listing Images:
  • The docker images command displays locally available images.
• Testing a Container:
  • The docker run command creates and runs a container.
  • The -it flag initiates an interactive shell within the container.
  • Example: docker run debian /bin/echo "Hello World"
• Running a Container in the Background:
  • The -d flag runs a container in the background.
  • Example: docker run -p 8080:80 --hostname nginx --name nginx -d nginx
• Listing Running Containers:
  • The docker ps command lists currently running containers.
• Executing Commands within a Container:
  • The docker exec command creates a new process within an existing container.
  • Example: docker exec -ti nginx bash
• Stopping and Starting Containers:
  • The docker stop command stops a container.
  • The docker start command starts a stopped container.
• Removing Containers:
  • The docker rm command removes a container.
• Volumes:
  • Docker volumes provide a mechanism for persistent storage for data-intensive applications.
  • They are independent of the container’s writable filesystem layers, preserving data even after a container is removed.

Networking

• Docker Networks:
  • docker network ls lists available networks:
    • bridge: The default network for connecting containers to the host network.
    • host: Shares the host’s network namespace with the container.
    • none: No network configuration.
  • The --net argument in docker run allows selecting a specific network for a container.
• Bridge Network:
  • A bridge is a Linux kernel feature that connects network segments.
  • Docker uses a bridge called docker0 on the host, where each container has a private virtual network interface within the bridged network range.

Image Building

• Building container images allows for the packaging of applications and their dependencies.
• Steps for Building an Image:
  • Base Image: Start by selecting a base image.
  • Application Code: Add application code, libraries, and dependencies.
  • Commit Changes: Commit any changes as new layers, saving the image to the local image database.
• Using the Built Image:
  • Create containers from the built image.
  • Push the image to a registry for sharing.