What is this "docker"
2 likes•427 views
Docker containers provide isolation at the system resource level using namespaces and control groups. This allows each container to run applications packaged with dependencies without conflict. Docker solves issues around dependency management and allows for fast iterative development. To use Docker, a container-enabled kernel is needed along with installing Docker on Windows or Linux. Images contain application code and dependencies and are obtained from Docker Hub or built locally. Docker Compose allows defining multi-container applications and their dependencies. Security with Docker includes capability dropping, namespaces, and profiles with AppArmor and SELinux to control access. Trusted registries and image scanning help ensure secure images.
![FROM ubuntu
MAINTAINER Kimbro Staken
RUN apt-get install -y software-properties-common python
RUN add-apt-repository ppa:chris-lea/node.js
RUN echo "deb http://us.archive.ubuntu.com/ubuntu/ precise universe" >> /etc/apt/
RUN apt-get update
RUN apt-get install -y nodejs
#RUN apt-get install -y nodejs=0.6.12~dfsg1-1ubuntu1
RUN mkdir /var/www
ADD app.js /var/www/app.js
CMD ["/usr/bin/node", "/var/www/app.js"]](https://image.slidesharecdn.com/whatisthisdocker-161209171608/85/What-is-this-docker-27-320.jpg)
![#include <tunables/global>
profile docker-default flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/base>
network,
capability,
file,
umount,
deny @{PROC}/{*,**^[0-9*],sys/kernel/shm*} wkx,
deny @{PROC}/sysrq-trigger rwklx,
deny mount,
deny /sys/[^f]*/** wklx,
deny /sys/f[^s]*/** wklx,](https://image.slidesharecdn.com/whatisthisdocker-161209171608/85/What-is-this-docker-62-320.jpg)
What is this "docker"
- 1. 1 WHAT IS THIS "DOCKER" ? Jean-Marc Meessen
- 3. I had a dream !
- 4. 2 3 My own copy of the database … that I can break at will My own iso-prod test environment … that I can break at will Easily share my con guration with colleagues. DEVOPS !
- 5. 4 ...And it became true !
- 6. 5 6 HELLO ! Jean-Marc MEESSEN Brussels, Belgium "Brol Engineer" @ Worldline Senior ESB Java Developer Development Infrastructure Expert Mentor Starting in January at Cloudbees
- 8. 8 AND YOU ? Developers ? Ops ? Security ? Managers ?
- 9. 9 YOU AND DOCKER ? Never heard about it ? Some "Proof of Concept" ? Use it every day ? In Production ?
- 10. 1011 TODAY’S TALK What are "containers" ? How to start ? Docker for the Java Dev
- 11. What are "containers" ?
- 12. 12
- 13. 13
- 14. 14
- 15. 1516 DOCKER CONTAINERS is not a virtualization technique, rather an isolation technology.
- 16. DOCKER CONTAINERS ARE : cgroups (control groups) limits CPU, memory, IOs, etc NameSpaces isolates and virtualizes system resources (process, mounts, networking)
- 17. 17
- 18. 18 APPLICATIONS PACKAGED WITH SYSTEM DEPENDENCIES new packaging paradigm one application works on Ubuntu with Python 2 second application works on Centos 7.2 with Python 3
- 19. 19 WHAT DOCKER SOLVES Escape the dependencies hell Fast iterative Infrastructure improvement Container "loader" & Container "shipper" (no more "it worked in Dev, now it’s OPS problem") easy onboarding of Devs. "Own test environment"
- 20. 20 How to start ?
- 21. 21 22 NEED A CONTAINER ENABLED "KERNEL"
- 22. AND FOR WINDOWS OR MAC OS X ? Install a virtual machine (ex VirtualBox) Ready made bundles: Docker Toolbox New, better integrated, clients Using (corporate) proxies: advanced topic
- 23. 23 How does it work ?
- 24. 24 25 LET ME SHOW YOU ….
- 25. HOW DO YOU GET IMAGES ? Note: an image is immutable you get them from DockerHub Corporate Registry Or build it yourself
- 26. 2627 BUILDING A DOCKER IMAGE Described in a Docker le
- 27. FROM ubuntu MAINTAINER Kimbro Staken RUN apt-get install -y software-properties-common python RUN add-apt-repository ppa:chris-lea/node.js RUN echo "deb http://us.archive.ubuntu.com/ubuntu/ precise universe" >> /etc/apt/ RUN apt-get update RUN apt-get install -y nodejs #RUN apt-get install -y nodejs=0.6.12~dfsg1-1ubuntu1 RUN mkdir /var/www ADD app.js /var/www/app.js CMD ["/usr/bin/node", "/var/www/app.js"]
- 28. DESCRIBE A COMPLETE INFRASTRUCTURE Complex systems Fuse ESB server MQ series servers Oracle database Use "docker-compose"
- 29. 28 29 DOCKER-COMPOSE one place to de ne your components how to (docker) build them what container should start rst networks (who can talk to whom) (data) volumes Security restrictions Etc.
- 30. 30 "BUILD, SHIP AND RUN"
- 31. 31 HOW TO LEARN ? Many tutorials available on-line Developer Beginner Linux Containers Beginner Windows Containers Intermediate (both Linux and Windows) Operations Beginner Intermediate https://training.docker.com/category/self-paced-online
- 32. 3233 HOW TO LEARN ? Docker playground http://play-with-docker.com/
- 33. Where is Docker heading ?
- 34. 34 DOCKER INC. Docker has been surprised by this techno " are" Very, very lively Open Source community "Batteries included" Standardization (RunC, etc.)
- 35. 35 WELL GROUNDED APPROACH Coming from the web hosting world
- 36. 3637 STATUS Was good for development and integration Start to be usable for Real Life Run Since December 2015
- 37. STATUS Start to offer enterprise level solutions "Docker Datacenter" Trusted Registry (Image scanning, sig/auth) Docker Universal Control Plane Docker Cloud
- 38. 3839 Docker for Java builders
- 41. MAVEN SEQUENCE pre-integration-test execute Docker "build" and "start" goals execute FlyWay migration integration-test execute Failsafe "verify" goal integration test make extensive use of DBunit post-integration-test execute Docker "stop" goal
- 42. 43 MAVEN INTEGRATION additional options (networking, volumes, docker-compose) ts nicely in Jenkins especially V2 and pipeline (but this is an other story)
- 43. 44 BASE IMAGES several base images are available, choose what is best suited openjdk (jdk and jre) openjdk:alpine maven Oracle JDK/JRE is not available from the shelf anymore. Need to build it yourself
- 44. 4546 DEPLOYMENT MODEL app-server embedded (self contained JAR)
- 45. 47 INSTALLATION MODES/TEST MODES add the JAR in the right directory execute the app installation script at image build time execute the app installation script at container run
- 46. SINGLE PURPOSE JVM thinks it is alone in the world JVM defaults based on the machine characteristics watch out several JVMs (in Docker) are running on the same machine
- 47. 48 JVM CONFIGURATION as on a physical host you need to speci y/limit the memory/cpu requirement of your JVM Docker offer the same tools. use them orchestrator like mesos or kubernetes can help you for this beware of Docker exec in Production
- 48. 49 DOCKER IN PRODUCTION my point of view of Docker in Production you need to have a very good understanding of what you do still in the early phase Docker works very well for state less application State full (with databases, etc) still in infancy. Recent announcement very promising
- 49. 50 Is Docker secure in Production ?
- 50. This is, in general, the reaction…
- 51. 5152
- 52. 53 THE SITUATION WITH DOCKER
- 53. 54 WHAT IS HE LOOKING FOR?
- 54. 55 WHAT IS HE LOOKING FOR? (user) Data Access other systems Privilege elevation
- 55. 56 WHAT ARE THE DANGERS WITH DOCKER? Kernel exploits Denial of service attack Container breakout Poisoned images Compromising Secrets
- 56. 57 IS DOCKER "SECURE" ? A lot of expectations, of illusions "Silver bullet" Competition positioning (VM, Con guration Mgt) Enviousness
- 57. 5859 "CONTAINER DO NOT CONTAIN !" Wrong perception by the "public" Tremendous progress in 3 years but usable…
- 58. 60 EQUIPPED WITH SECURITY TOOLS
- 59. 61 IN PARTICULAR Cap drop User namespace selinux / apparmor
- 60. CAPABILITY DROP options to the "Docker run" goes beyond the root/non-root dichotomy example: container with NTP docker run --cap-drop ALL --cap-add SYS_TIME ntpd
- 61. 6263 SELINUX / APPARMOR pro les are called at each "Docker run" Allow to go much further in the granularity this program (ex ping) has no access to the network
- 62. #include <tunables/global> profile docker-default flags=(attach_disconnected,mediate_deleted) { #include <abstractions/base> network, capability, file, umount, deny @{PROC}/{*,**^[0-9*],sys/kernel/shm*} wkx, deny @{PROC}/sysrq-trigger rwklx, deny mount, deny /sys/[^f]*/** wklx, deny /sys/f[^s]*/** wklx,
- 64. 64 66 Malicious contents Contains vulnerabilities or bugged applications
- 65. 67 TRUSTED REGISTRY Systematic use of TLS Re-enforcement of the layers integrity Upgraded with version 1.10
- 66. NOTARY System of image signature and its validation Validation of the author and content non alteration Protection Against Image Forgery Protection Against Replay Attacks Protection Against Key Compromise Clever usage of physical key storage
- 67. 68 NAUTILUS (now called "Docker Security Scanning") Docker image scanner vulnerabilities (CVE check) Licence validation Image Optimisation Simpli ed functional tests
- 69. 70 RECOMMENDATIONS Keep your host/images up-to-date "Bulkheading" Seperate disk partition for Docker Don’t run other (non-Docker) applications on the same host Container in a VM ? Limit inter-container communications log/audit trails Access control
- 70. 71 RECOMMENDATIONS Do not use "priviliged" if it is not necessary Applicative users in the containers Where are my images coming from ? are they up-to-date ? Access rights on the les
- 71. 7273 CONCLUSIONS "Is Docker 'secure' ?" No more or less then the door of an apartment Security is everyone’s business : DevOps + SecOps
- 72. 74 THANK YOU !