1. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Docker Overview Automating software deployment in containers Patrick Galbraith, Advanced Technology Group

2. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 2 What is a container? ●OS-level virtualization: multiple isolated user-space instances ●A group of processes put together in an isolated environment. ●LXC, OpenVZ, Parallels Vurtuozzo, HPUX containers (SRP), etc ●Not a Hypervisor! ●Doesn't "boot" an OS. Loads the application in question with the containerized/isolated environment

3. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 3 What is a container?

4. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 4 Hypervisor vs. Container ●Container - only libraries and components needed for application vs. entire OS ●Container runs within OS (using Cgroups). Hypervisor runs on software that emulates hardware ●Much smaller, easier to package and store vs. entire VM image ●VERY fast to start! ●Container runs using (a) specific process(es) ●You do not need ssh access to necessarily troubleshoot a problem

5. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 5 What is LXC? ●Linux containers – released 2.6.24 ●Kernel namespaces – the core ingredient to containers working: PID, IPC (PostgreSQL), uts (what will be seen by a group of processes), mount, network and user ●Cgroups (control groups) -- limit, account and isolate resource usage (CPU, memory, disk I/O, etc.) of process groups ●Basis of Docker

6. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 6 Kernel Namespaces ●The core ingredient to containers working PID each namespace has its own PID 1 (init). Processes can’t affect parent or sibling sudo /proc filesystem per process IPC Think about apps like PostgreSQL) Isolated IPC

7. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 7 Kernel Namespaces uts what will be seen by a group of processes The hostname that will be seen by a group of processes mnt chroot – but taken a step further Each container has and only sees its mount points Path translated to root of the namespace Net Isolated network interfaces, routing tables and iptables, etc

8. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 8 What is Docker? ●Software to manage applications inside of containers ●A shipping container system for code ●Written in Go, Opensource dotCloud ●"literally LXC with some awesomesauce on top" ●CLI - for managing images, containers, network, etc ●Applicaiton server (docker daemon) with REST API ●Client of repositories ●Containers using LXC ●Union File system (AUFS)

9. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 9 Why Docker? ●Easy to containerize everything you need to deploy an app ●Build once, run anywhere ●Configure once, run anything ●Small footprint in terms of disk and memory ●Well-suited for SaaS/PaaS ●Security - you are not running a VM and associated OS

10. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 10 What is missing in Docker? ●Upstart does not work ●Some oddities with networking (might be a familiarity issue- will explain in talk) ●Officially "Docker is currently under heavy developement. It should not be used in production (yet)."

11. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 11 Docker terminology ●Images ●Dockerfile ●Containers ●Image repo

12. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 12 Docker terminology

13. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 13 Docker Guts ●Both SQLite for data /var/lib/docker/linkgraph.db and JSON in /var/lib/docker/graph (per image) ●Container state in /var/lib/docker/containers (config for container, lxc config, host config, etc) ●Stores repository info in JSON /var/lib/docker/repositories-aufs ●You can access image and container file-system contents in /var/lib/docker/aufs/mnt/ -- both running and stopped. Caveat: Watch your disk space!

14. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 14 Image terminology ●Images - read-only layer ●Parent/descendant relationship ●Lower images parent of upper images ●Images repository: images can be pushed to and pulled from ●Images unique 64 hexadecimal digit string (internally a 256bit value). ●Dockerfile used for building images

15. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 15 Basic usage example ●docker run ●Make changes ●docker commit ●docker push

16. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 16 Dockerfile ●docker build –t username/my_image ●Container runs ●Each step results in an a commit (image being created) ●Show examples ●Show building an image using a Dockerfile ●Show image files remaining ●Explain CMD vs. ENTRYPOINT

17. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 17 More feature examples ●Run a container: docker run ●Make changes to running container ●Save container state as image: docker commit ●Push to repository: docker push ●Other docker image commands ●See hierarchy with ‘docker images –tree’ as well as save to graph in graphviz format and view in a browser ●Image history: docker history

18. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 18 Container terminology ●Images - read-only layer ●Parent/descendant relationship or base image and lower/upper images ●Lower images parent of upper images ●Images can be pushed to and pulled from either public or private repositories ●Images don't take much space, hence you can have a many images available in your environment

19. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 19 Working with containers ●Show running a container ●Show how to view running and terminated containers ●Show an example of building an image as well as an image running some arbitrary commands using ‘docker top’ ●Show other docker commands ●Copy a file from a running container: docker

20. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 20 OpenStack ●The Docker driver is a hypervisor driver for Nova Compute ●Since Docker manages images and launches containers from those images, it is used by both Nova and Glance ● WARNING nova.virt.docker.driver [-] The docker driver does not meet the Nova project's requirements for quality verification and is planned for removal. This may change, but users should plan accordingly. Additional details here: https://wiki.openstack.org/wiki/HypervisorSupportMatrix/Depr ecationPlan ●Devstack – demo

21. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 21 OpenStack

22. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 22 Orchestration ●Chef, Puppet, SaltStack, Ansible ●Build image or modify running container ●For management, containers are a different bird. You need to run agent/minion or in the case of Ansible, sshd in order to manage ●Management may not be as long-term as a VM ●Cron job to run agent once (per Jerome Petazzoni) or even ssh and run. ●Demo – if time to get ansible working with running container

23. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 23 Conclusions ●Very exciting technology ●Backed by corporate entity, series-B funding ●Work with OpenStack is moving forward ●Perfect for PaaS/SaaS ●Helpful community ●A whole other layer of management that leaves other options besides openstack ●I love this for testing – I don’t have to wait for VMs to boot!

24. © Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 24 Resources ●Lightweight Virtualization: LXC containers and AUFS http://www.socallinuxexpo.org/sites/default/files/presen tations/Jerome-Scale11x%20LXC%20Talk.pdfBacked by corporate entity, series-B funding ●How to configure Docker to start docker on a specific IP address range ●Docker and Openstack: https://wiki.openstack.org/wiki/Docker https://wiki.openstack.org/wiki/Docker ●http://www.slideshare.net/dotCloud/docker-open-stack