The Flowers of Evil

Painless Docker & its ecosystem with real-world examples. It is a detailed step-by-step guide to create, deploy, optimize, secure, debug, log, orchestrate & monitor Docker, Docker clusters & modern Docker-based microservices from development to production. Docker is a powerful tool, but learning how to use it effectively can be time-consuming. If you are used to the old paradigms of development and deployment, this paradigm shift to Docker's containerization can be challenging, as it introduces completely new concepts and workflows. Docker's approach to isolated environments, image management, and microservice architecture requires a significant shift in understanding from traditional methods. Many engineers and developers feel overwhelmed by the rapidly growing cloud and containerization ecosystem, making it challenging for them to enter the world of containers. "Painless Docker" aims to bridge this gap, providing a comprehensive guide to help you smoothly transition to Docker's innovative ecosystem, enhancing your development and deployment processes efficiently. "Painless Docker" serves as a gateway to Docker's world, helping you become proficient in its usage. You'll discover that using Docker is easy and efficient for your development and operations environments. "Painless Docker" is a comprehensive and detailed guide that covers Docker and a significant portion of its ecosystem. This guide is designed for beginners and intermediate levels, providing step-by-step guidance. It starts with basic concepts and progresses to advanced features. By the end, readers will have mastered Docker and microservices, including their development and production usage. The guide also covers Docker Compose, Docker Swarm, and important tools from the ecosystem. These are the 10 most important things you will learn Basics and advanced concepts of Docker: An in-depth exploration of Docker beyond just an introduction. Building and deploying your own images in production: From the buil Table of Contents Preface To Whom Is This Guide Addressed? How To Properly Enjoy This Guide Join the community The Missing Introduction to Containerization We Are Made by History Jails, Virtual Private Servers, Zones, Containers, and VMs: What's the Difference Anyway? OS Containers vs. App Containers Docker: Container or Platform? The Open Container Initiative: What is a Standard Container? A Deep Dive into Container Prototyping with runC Industry Standard Container Runtimes containerd, shim and runC: How Everything Works Together Adding a New Runtime to Docker Does CRI Mean the Death of Docker? The Moby Project Installing and Using Docker Installing Docker Docker CLI Docker Events Using Docker API To List Events Docker Containers Creating Containers Running Containers Restarting Containers Pausing and Unpausing Containers Stopping Containers Killing Containers Removing Containers Container Lifecycle Starting Containers Automatically Accessing Containers Ports Running Docker In Docker Managing Containers Resources Memory Usage Reservations and Limits CPU Usage Reservations and Limits Docker Images What is an Image? Images are Layers Images, Intermediate Images & Dangling Images The Dockerfile and its Instructions The Base Image Extending the Base Image Exploring Images' Layers Building an Image Using a Dockerfile Creating Images out of Containers Migrating a VM to a Docker Image Creating and Understanding the Scratch Image Docker Hub and Docker Registry Docker Hub, Public and Private Registries Docker Hub: The Official Docker Registry Using Docker Hub DockerHub Alternatives Creating a Private Docker Registry Optimizing Docker Images Less Layers = Faster Builds? Is There a Maximum Number of Layers? Optimizing Dockerfile Layer Caching for Dependency Management The Multi-Stage Build Smaller Images Other Techniques: Squashing, Distroless, etc Docker Volumes What is a Docker Volume? Creating and Using Docker Volumes Listing and Inspecting Docker Volumes Named Volumes vs Anonymous Volumes Bind Mounts Data Propagation Dangling Volumes TMPFS Mounts Docker Volume From Containers Docker Logging How Docker Logs Work Logging Best Practices and Recommendations Logging Drivers Docker Daemon Logging Docker Networks Docker Networks Types The (System) Bridge Network The (User) Bridge Network The Host Network The None Network The Macvlan Network The Overlay Network The Ingress Network Docker Links Docker Compose What is Docker Compose and Why Should I Care? Installing Docker Compose Understanding Docker Compose and How it Works Docker Compose Dependencies Creating Portable Docker Compose Stacks Docker Compose Logging Understanding Docker Compose Syntax Using Dockerfile with Docker Compose Docker Compose with Bind Mounts Creating Custom Networks Docker Compose Secrets Scaling Docker Compose Services Cleaning Docker Delete Volumes Delete Networks Delete Images Remove Docker Containers Cleaning Up Everything Docker Plugins Orchestration - Docker Swarm What is Docker Swarm? Creating a Swarm Cluster Swarm Services and Tasks Networking in Docker Swarm Performing Operations on Nodes Multi-manager Docker Swarm Docker Swarm Environment Variables and Secrets Docker Swarm Volumes Deploying a WordPress Application on Docker Swarm Docker Swarm Global Services Docker Swarm Resouce Management Docker Swarm Stacks Docker Swarm Rolling Updates Using an External Load Balancer with Docker Swarm Using Traefik as a Front-End Load Balancer with Docker Swarm Docker Swarm Logging Docker Swarm vs. Kubernetes Docker Desktop What is Docker Desktop? How to Install Docker Desktop Common Security Threats Docker vs. VMs: Which is more secure? Kernel Panic & Exploits Container Breakouts & Privilege Escalation Poisoned Images Denial-of-service Attacks Compromising secrets Application Level Threats Host System Level Treats Docker Security Best Practices Implement Security by Design setuid/setgid Binaries Control Resources Use Notary to Verify Image Integrity Scan Images Set Container Filesystem to Read Only Set Volumes to Read-Only Do Not Use the Root User Run the Docker Daemon in Rootless Mode Do Not Use Environment Variables For Sensitive Data Use Secret Management Tools Do Not Run Containers in the Privileged Mode Turn Off Inter-Container Communication Only Install Necessary Packages Make Sure Docker is up to Date Security Through Obscurity Use Limited Linux Capabilities Use Seccomp Use AppArmor Use SELinux Docker API Docker SDKs Docker API: Hello World Prototyping a Log Collector Service Debugging And Troubleshooting Docker Daemon Logs Activating Debug Mode Debugging Docker Objects Troubleshooting Docker Using Sysdig The Ultimate Docker Cheat Sheet Installation Docker Registries & Repositories Running Containers Starting & Stopping Containers Getting Information about Containers Managing Images Networking Cleaning Docker Docker Swarm Docker Scout Suite Resources Afterword What's next? Thank you About the author Join the community Feedback