asdsadsadasaads

1. Docker Fundamentals
Mohamed Shokry

2. Agenda
What is cloud
native?
Pillars of cloud
native
What is Docker? What is Container?
What is Docker
image and image
layers?
What is Dockerfile?
What are Docker
registries?
Docker
Architecture
Linux Namespaces
and cgroups and
Union file systems
What is Docker
volume?
What is Docker
network?
Service images vs
Executable images
What is Docker
compose?
Container
orchestration

3. What is “Cloud Native”?
The Cloud Native Computing Foundation provides the official
definition:
Cloud-native technologies empower organizations to build and run scalable
applications in modern, dynamic environments such as public, private, and
hybrid clouds. Containers, service meshes, microservices, immutable
infrastructure, and declarative APIs exemplify this approach.
These techniques enable loosely coupled systems that are resilient,
manageable, and observable. Combined with robust automation, they allow
engineers to make high-impact changes frequently and predictably with
minimal toil.

4. What is “Cloud Native”? Cont’d
Netflix: Has 600+ services in
production. Deploys 100 times
per day.
Uber: Has 1,000+ services in
production. Deploys several
thousand times each week.
WeChat: Has 3,000+ services in
production. Deploys 1,000 times
a day.

5. Pillars of Cloud Native

6. Pillars of Cloud Native:
The Cloud
• Cloud Native apps treat the underlying infrastructure as disposable -
provisioned in minutes and resized, scaled, or destroyed on demand – via
automation.
• Consider the widely accepted DevOps concept of Pets vs. Cattle
• In a traditional data center, servers are treated as Pets: a physical machine,
given a meaningful name, and cared for. You scale by adding more resources
to the same machine (scaling up). If the server becomes sick, you nurse it
back to health. Should the server become unavailable, everyone notices.
• The Cattle service model is different. You provision each instance as a
virtual machine or container. They’re identical and assigned a system
identifier such as Service-01, Service-02, and so on. You scale by creating
more of them (scaling out). When one becomes unavailable, nobody notices

7. Pillars of Cloud Native:
The Cloud Cont’d
• The cattle model embraces immutable infrastructure. Servers aren’t
repaired or modified. If one fails or requires updating, it’s destroyed, and a
new one is provisioned – all done via automation
• Cloud-native systems embrace the Cattle service model. They continue to
run as the infrastructure scales in or out with no regard to the machines
upon which they’re running

8. What is Docker?
• Docker is a tool that help you to
create and manage containers

9. What is Docker? Cont’d

10. What is
Container?
• Containers are not VMs.
• A container is an isolated
(namespaces) and restricted
(cgroups, capabilities, seccomp)
process.
• How to create a container ? If you
have docker installed, you can run
a CentOS container using below
command
# docker run -it centos bash

11. What is Docker image?
Docker image is a read-only template with instructions for creating a Docker container

12. FROM node:18-alpine
WORKDIR /app
COPY . .
RUN yarn install --
production
CMD ["node", "src/index.js"]
EXPOSE 3000
docker build -t getting-started
.
shokry@minikube:~/getting-started$ docker images
REPOSITORY TAG IMAGE ID CREATED
SIZE
getting-started latest 9178a6d68d32 About a minute ago
130MB
How do I build the
docker image?

13. What is Docker image layers?
• Layers are what make up an image.
Each layer is a “diff” that contains
the changes made to the image since
the last one was added
• Each layer corresponds to certain
instructions in your Dockerfile

14. What is Docker File?
• A Dockerfile is a text document that
contains all the commands a user
could call on the command line to
assemble an image. Using docker
build users can create an automated
build that executes several
command-line instructions in
succession
• Example for building an image using
docker file
#cd ~/image_content_path
#docker built -t demo-app .

15. shokry@minikube:~/getting-started$ docker inspect getting-started | jq .[].RootFS.Layers
[
"sha256:94e5f06ff8e3d4441dc3cd8b090ff38dc911bfa8ebdb0dc28395bc98f82f983f",
"sha256:ecbef68c786c92ccf75b9cc7ad205206c2a3b51d3d190a516caecaf82554f060",
"sha256:030e06ea331f4543c9bb1b30fb676e6edb5c28b6e91288b2ba52b95a7ebbe4bd",
"sha256:05c5b8408e7396bf52ce92d360ad9adc5f1c1d705ce95e501baac6507b518d75",
"sha256:3a46eb9c01ff4eb6d8e39eb26f80df939a25dc704a94583e250843742512619d",
"sha256:62af293d35310627f2083ae537b1e26aef205951b1b73a30d514296ff60b194d",
"sha256:b62ead727bf05464d9e8d3d4d05b6b4aff8c6708d287b5b4b3888f977cdb043c"
]
Layers
+
Manifest = Image

16. shokry@minikube:~$ docker manifest inspect hello-world
{
"schemaVersion": 2,
"mediaType": "application/vnd.oci.image.index.v1+json",
"manifests": [
{
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"size": 861,
"digest": "sha256:e2fc4e5012d16e7fe466f5291c476431beaa1f9b90a5c2125b493ed28e2aba57",
"platform": {
"architecture": "amd64",
"os": "linux"
}
},
...
{
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"size": 863,
"digest": "sha256:2d4e459f4ecb5329407ae3e47cbc107a2fbace221354ca75960af4c047b3cb13",
"platform": {
"architecture": "arm64",
"os": "linux",
"variant": "v8"
}
},
...
{
"mediaType": "application/vnd.docker.distribution.manifest.v2+json",
"size": 946,
"digest": "sha256:d9958c926e37a9700d85698bc9872cae110bbbb26f551a9684da9a8332dbb778",
"platform": {
"architecture": "amd64",
"os": "windows",
"os.version": "10.0.20348.2529"
}
}
]
}
Manifest Example

17. What are Docker registries?
• A Docker registry stores Docker images where any host can pull images
• Docker Hub is a public registry that anyone can use, and Docker is
configured to look for images on Docker Hub by default
• You can even run your own private registry

18. Docker Architecture
• Docker uses a client-server architecture
• The Docker client talks to the Docker daemon, which does the heavy lifting
of building, running, and distributing your Docker containers
• The Docker client and daemon can run on the same system, or you can
connect a Docker client to a remote Docker daemon
• The Docker client and daemon communicate using a REST API, over UNIX
sockets or a network interface

22. More on containers
• Containers are runnable instance of an image
• Container are built using 3 main components
 Namespaces
 Control Groups “cgroups”
 Union Filesystem

23. Linux Namespaces
• Namespaces are a feature of the Linux kernel that partitions kernel
resources such that one set of processes sees one set of resources while
another set of processes sees a different set of resources
• Namespaces are simply isolation of system resources “Jails”
• Current available Linux Namespaces
 Cgroup
 IPC
 Network
 Mount
 PID
 Time
 User
 UTS

24. shokry@minikube:~$ lsns -l
NS TYPE NPROCS PID USER COMMAND
4026531834 time 4 1583 shokry /lib/systemd/systemd --user
4026531835 cgroup 4 1583 shokry /lib/systemd/systemd --user
4026531836 pid 4 1583 shokry /lib/systemd/systemd --user
4026531837 user 4 1583 shokry /lib/systemd/systemd --user
4026531838 uts 4 1583 shokry /lib/systemd/systemd --user
4026531839 ipc 4 1583 shokry /lib/systemd/systemd --user
4026531840 net 4 1583 shokry /lib/systemd/systemd --user
4026531841 mnt 4 1583 shokry /lib/systemd/systemd --user
How to list
namespaces

25. Linux Control Groups “cgroups”
• Cgroups are a facility built into the kernel that allow the administrator to
set resource utilization limits on any process on the system. In general,
cgroups control:
 The number of CPU shares per process
 The limits on memory per process
 Block Device I/O per process
 Which network packets are identified as the same type so that another application
can enforce network traffic rules.

26. Union File system
• Union mount is a type of a filesystem that can create an illusion of merging
contents of several directories into one without modifying its original
(physical) sources. This can be useful as we might have related sets of files
stored in different locations or media, and yet we want to show them in
single, merged view
• Why it is important for docker? Many images that we use to spin up our
containers are quite bulky whether it's ubuntu with size of 72MB or nginx
with size of 133MB. It would be quite expensive to allocate that much space
every time we'd like to create a container from these images. Thanks to
union filesystem, Docker only needs to create thin layer on top of the image
and rest of it can be shared between all the containers. This also provides
the added benefit of reduced start time, as there's no need to copy the image
files and data

27. Union File system Cont’d
• Examples of unionFS implementations:
 UnionFS: UnionFS doesn't seem to be actively developed anymore
 AUFS: A re-implemenation of original UnionFS that added many new features but
was rejected for merging into mainline Linux kernel. Aufs was default driver for
Docker on Ubuntu/Debian but was replaced by OverlayFS
 OverlayFS: included in Linux Kernel since 3.18 (26 October 2014). This is the
filesystem used by default overlay2 Docker driver
 ZFS: ZFS is union filesystem created by Sun Microsystems (now Oracle). It has
some interesting features like hierarchical checksumming, native handling of
snapshots and backup/replication or native data compression and deduplication
 Btrfs: Btrfs is a default filesystem of Fedora 33. It also has some useful features
such as block-level operations, defragmentation, writeable snapshots and a lot more

28. LET’S GO DEEPER INTO
DOCKER DETAILS

29. Docker Container operations
• Create and run a container from an image, with a custom name:
docker run --name <container_name> <image_name>
• Run a container with and publish a container’s port(s) to the host.
docker run -p <host_port>:<container_port> <image_name>
• Run a container in the background
docker run -d <image_name>
• Start or stop an existing container:
docker start|stop <container_name> (or <container-id>)
• Remove a stopped container:
docker rm <container_name>
• Open a shell inside a running container:
docker exec -it <container_name> sh

30. Docker Container operations Cont’d
• Fetch and follow the logs of a container:
docker logs -f <container_name>
• To inspect a running container:
docker inspect <container_name> (or <container_id>)
• To list currently running containers:
docker ps
• List all docker containers (running and stopped):
docker ps --all
• View resource usage stats
docker container stats

31. Docker File
(Container File)
• A Dockerfile is a text file that
contains a series of instructions on
how to build a Docker image
• Each instruction in a Dockerfile
creates a layer in the image, which
can be cached and reused to speed
up subsequent builds
• The Dockerfile specifies
everything needed to set up the
environment inside a container,
including the base image,
dependencies, configuration files,
environment variables, and
commands to run

32. # Use an official Python runtime as a parent image
FROM python:3.8-slim
# Set the working directory in the container
WORKDIR /usr/src/app
# Copy the current directory contents into the container at /usr/src/app
COPY . .
# Install any needed packages specified in requirements.txt
RUN pip install --no-cache-dir -r requirements.txt
# Make port 80 available to the world outside this container
EXPOSE 80
# Define environment variable
ENV NAME World
# Run app.py when the container launches
CMD ["python", "app.py"]

33. Docker Image operations
• Build an Image from a Dockerfile
docker build -t <image_name>
• Build an Image from a Dockerfile without the cache
docker build -t <image_name> . –no-cache
• List local images
docker images
• Delete an Image
docker rmi <image_name>
• Remove all unused images
docker image prune

34. What is Docker
volume?
• By default, docker container uses
ephemeral volumes which gets
removed when container is deleted
• A Docker volume is a mechanism
for persisting data generated by
and used by Docker containers
• Volumes are stored outside the
container's filesystem and are
managed by Docker
• This allows data to persist even
after the container is removed

35. Docker volume operation
• List docker volumes
docker volume ls
• Get detailed info about volume
docker volume inspect <volume name>
• Create a docker volume
docker volume create <volume name>
• Remove volume
docker volume rm <volume name>
• Remove all unused volumes
docker volume prune

36. What is Docker
network?
• A Docker network is a virtual network created by
Docker that allows containers to communicate
with each other and with external systems
• Docker networks provide isolation, security, and
routing capabilities for containers
• By default, Docker provides several network
drivers to create different types of networks
tailored to various use cases
• Types of Docker Networks:
 Bridge (Default)
 Host
 Overlay
 IPVLAN
 MACVLAN
 None

37. Docker network operation
• List docker networks
docker network ls
• Get detailed info about docker network
docker network inspect <network name>
• Create docker network
docker network create <network name>
• Remove docker network
docker network rm <network name>
• Connect docker container to a network
docker network connect <network name > <container ID>
• Specify IP address of the container interface when connecting to a network
Docker network connect --ip <IP> <network name > <container ID>
• Disconnect container from a network
docker network disconnect <network name> <container ID>

38. Service images vs Executable images
• Traditionally, container images are used for long running processes:
services that are run on a server, not influencing the host because
they are contained. We call these service images. Web servers, load
balancers and databases are good examples of service images
• Container images can also be used for short lived processes: a
containerized executable meant to be run on your computer. These
containers execute a single task, are short lived and can generally be
removed after use. We call these executable images
• The main difference between two types are the “Dockerfile”
instructions. Service images runs scripts that starts application
accepting parameters while executable images uses “ENTRYPOINT”
instruction to execute a specific command when spinning a container
from the image

39. FROM ubuntu:24.04
CMD ["echo", "CMD
variant"]
FROM ubuntu:24.04
ENTRYPOINT ["echo", "CMD
variant"]
docker build -t cmd-v1 . docker build -t cmd-v2 .
$ docker run -it cmd-v1
CMD variant
$ docker run -it cmd-v2
ENTROYPOINT variant
$ docker run -it cmd-v1 echo
"Hello from Docker"
Hello from Docker
$ docker run -it cmd-v2 echo "Hello from
Docker"
ENTROYPOINT variant echo Hello from Docker
$ docker run --entrypoint "/bin/echo" cmd-
v2 "Hello from Docker"
Hello from Docker
Build Build
Run Run
Override Override

40. Docker Compose

41. What is Docker compose?
• Docker Compose is a tool used for defining and running multi-
container Docker applications
• It allows you to manage a multi-container environment by defining
the services, networks, and volumes needed in a single YAML file,
called docker-compose.yml
• With Docker Compose, you can easily start, stop, and configure
multiple containers as a single application.

42. networks:
counter-net:
volumes:
counter-vol:
services:
web-fe:
build: .
command: python app.py
ports:
- target: 8080
published: 5001
networks:
- counter-net
volumes:
- type: volume
source: counter-vol
target: /app
redis:
image: "redis:alpine"
networks:
counter-net:

43. What if we have thousands
of containers? Do we still
manage it using docker
command for each single
container?

44. NO, we have container
orchestration tools

45. Popular container orchestration tools
• Kubernetes
• Hasicorp Nomad
• Docker Swarm
• Apache Mesos

46. Thanks