product iamge

Docker for Developers: Develop and run your application with Docker containers using DevOps tools for continuous delivery

This document was uploaded by one of our users. The uploader already confirmed that they had the permission to publish it. If you are author/publisher or own the copyright of this documents, please report to us by using this DMCA report form.

Download
Search on Amazon

Simply click on the Download Book button.

Yes, Book downloads on Ebookily are 100% Free.

Sometimes the book is free on Amazon As well, so go ahead and hit "Search on Amazon"

Learn how to deploy and test Linux-based Docker containers with the help of real-world use cases

Key Features

  • Understand how to make a deployment workflow run smoothly with Docker containers
  • Learn Docker and DevOps concepts such as continuous integration and continuous deployment (CI/CD)
  • Gain insights into using various Docker tools and libraries

Book Description

Docker is the de facto standard for containerizing apps, and with an increasing number of software projects migrating to containers, it is crucial for engineers and DevOps teams to understand how to build, deploy, and secure Docker environments effectively. Docker for Developers will help you understand Docker containers from scratch while taking you through best practices and showing you how to address security concerns.

Starting with an introduction to Docker, you'll learn how to use containers and VirtualBox for development. You'll explore how containers work and develop projects within them after you've explored different ways to deploy and run containers. The book will also show you how to use Docker containers in production in both single-host set-ups and in clusters and deploy them using Jenkins, Kubernetes, and Spinnaker. As you advance, you'll get to grips with monitoring, securing, and scaling Docker using tools such as Prometheus and Grafana. Later, you'll be able to deploy Docker containers to a variety of environments, including the cloud-native Amazon Elastic Kubernetes Service (Amazon EKS), before finally delving into Docker security concepts and best practices.

By the end of the Docker book, you'll be able to not only work in a container-driven environment confidently but also use Docker for both new and existing projects.

What you will learn

  • Get up to speed with creating containers and understand how they work
  • Package and deploy your containers to a variety of platforms
  • Work with containers in the cloud and on the Kubernetes platform
  • Deploy and then monitor the health and logs of running containers
  • Explore best practices for working with containers from a security perspective
  • Become familiar with scanning containers and using third-party security tools and libraries

Who this book is for

If you're a software engineer new to containerization or a DevOps engineer responsible for deploying Docker containers in the cloud and building DevOps pipelines for container-based projects, you'll find this book useful. This Docker containers book is also a handy reference guide for anyone working with a Docker-based DevOps ecosystem or interested in understanding the security implications and best practices for working in container-driven environments.

Table of Contents

  1. Introduction to Docker
  2. Using VirtualBox and Docker Containers for Development
  3. Sharing Containers Using Docker Hub
  4. Composing Systems Using Containers
  5. Alternatives for Deploying and Running Containers in Production
  6. Deploying Applications with Docker Compose
  7. Continuous Deployment with Jenkins
  8. Deploying Docker Apps to Kubernetes
  9. Cloud-Native Continuous Deployment Using Spinnaker
  10. Monitoring Docker Using Prometheus, Grafana, and Jaeger
  11. Scaling and Load Testing Docker Applications
  12. Introduction to Container Security
  13. Docker Security Fundamentals and Best Practices
  14. Advanced Docker Security – Secrets, Secret Commands, Tagging, and Labels
  15. Scanning, Monitoring, and Using Third-Party Tools
  16. Conclusion – End of the Road, but not the Journey

Author(s): Richard Bullington-McGuire, Andrew K. Dennis, Michael Schwartz
Publisher: Packt Publishing
Year: 2020

Language: English
Commentary: True PDF
Pages: 468

Cover
Copyright
About PACKT
Contributors
Table of Contents
Preface
Section 1: An Introduction to Docker – Containers and Local Development
Chapter 1: Introduction to Docker
The drivers for Docker
Co-located hosting
Self-hosting
Data centers
Using virtualization to economize resource usage
Addressing the increasing power requirements
Using containers to further optimize data center resources
Summary
Further reading
Chapter 2: Using VirtualBox and Docker Containers for Development
Technical requirements
Host filesystem pollution problem
Using VirtualBox for virtual machines
Introduction to virtualization
Creating a virtual machine
Guest additions
Installing VirtualBox
Using Docker containers
Introduction to containers
Using Docker for development
Getting started with Docker
Automating Docker commands via sh scripts
Summary
Further reading
Chapter 3: Sharing Containers Using Docker Hub
Technical requirements
Introducing Docker Hub
Interacting with Docker Hub from the command line
Using the Docker Hub website
Implementing a MongoDB container for our application
Running a shell within a container
Introducing the microservices architecture
Scalability
Inter-container communication
Implementing a sample microservices application
Sharing your containers on Docker Hub
Summary
Further reading
Chapter 4: Composing Systems Using Containers
Technical requirements
Introduction to Docker Compose
The problem with .sh scripts
Docker Compose configuration files
Inheritance using multiple configuration files
The depends_on option
Adding port bindings using overrides
Using Docker local networking
Networking using .sh scripts
Networking with Docker Compose
Binding a host filesystem within containers
Optimizing our container size
Using the build.sh script
Other composition tools
Docker Swarm
Kubernetes
Packer
Summary
Further reading
Section 2: Running Docker in Production
Chapter 5: Alternatives for Deploying and Running Containers in Production
Technical requirements
Example application – ShipIt Clicker
Running Docker in production – many paths, choose wisely
What is the minimum realistic production environment?
Bare minimum – run Docker and Docker Compose on one host
Docker support
Problems with single-host deployment
Managed cloud services
Google Kubernetes Engine
AWS Elastic Beanstalk
AWS ECS and Fargate
AWS EKS
Microsoft Azure Kubernetes Service
Digital Ocean Docker Swarm
Running your own Kubernetes cluster – from bare metal to OpenStack
Deciding on the right Docker production setup
Exercise – join the ShipIt Clicker team
Exercise – choosing from reasonable deployment alternatives
Exercise – Dockerfile and docker-compose.yml evaluation
Summary
Chapter 6: Deploying Applications with Docker Compose
Technical requirements
Example application – ShipIt Clicker v2
Selecting a host and operating system for single-host deployment
Requirements for single-host deployment
Preparing the host for Docker and Docker Compose
Using operating system packages to install Docker and Git
Deploying using configuration files and support scripts
Re-examining the initial Dockerfile
Re-examining the initial docker-compose.yml file
Preparing the production .env file
Supporting scripts
Exercise – keeping builds off the production server
Exercise – planning to secure the production site
Monitoring small deployments – logging and alerting
Limitations of single-host deployment
No automatic failover
Inability to scale horizontally to accept more load
Tracking down unstable behavior based on incorrect host tuning
Loss of single host could be disastrous – backups are essential
Case study – migrating from CoreOS and Digital Ocean to CentOS 7 and AWS
Summary
Further reading
Chapter 7: Continuous Deployment with Jenkins
Technical requirements
Example application – ShipIt Clicker v3
Using Jenkins to facilitate continuous deployment
Avoid these traps
Using an existing Jenkins server
Setting up a new Jenkins server
How Jenkins can support continuous deployment
The Jenkinsfile and host connectivity
Testing Jenkins and Docker with a pipeline script
Driving configuration changes through Jenkins
Using Git and GitHub to store your Jenkinsfile
Changing the origin of all checked out repositories
Creating Jenkins environment variables for production support
Building Docker containers and pushing them to Docker Hub
Pushing to Docker Hub and triggering a production deployment
Deploying to multiple environments through multiple branches
Creating a staging environment
Creating Jenkins environment variables for staging support
Deploying by force-pushing to the staging branch
Complexity and limits to scaling deployments through Jenkins
Managing multiple hosts
The complexity of build scripts
How do you know when you have hit the limit?
Summary
Further reading
Chapter 8: Deploying Docker Apps to Kubernetes
Technical requirements
Options for Kubernetes local installation
Minikube
Verifying that your Kubernetes installation works
Deploying a sample application – ShipIt Clicker v4
Deploying the NGINX Ingress Controller and ShipIt Clicker locally
Choosing a Kubernetes distribution
Google Kubernetes Engine
AWS EKS
Microsoft Azure Kubernetes Service
Reviewing other relevant options
Objects
ConfigMaps
Pods
Nodes
Services
Ingress Controllers
Secrets
Namespaces
Spinning up AWS EKS with CloudFormation
Introducing the AWS EKS Quick Start CloudFormation templates
Preparing an AWS account
Launching the AWS EKS Quick Start CloudFormation templates
Configuring the EKS cluster
Deploying an application with resource limits to Kubernetes on AWS EKS
Annotating ShipIt Clicker to use the ALB Ingress Controller
Using AWS Elastic Container Registry with AWS EKS
Creating an ECR repository
Local example – labeled environments in the default namespace
Staged environments – Dev, QA, staging, and production
Summary
Chapter 9: Cloud-Native Continuous Deployment Using Spinnaker
Technical requirements
Improving your setup for Kubernetes application maintenance
Managing the EKS cluster from your local workstation
Troubleshooting kubectl connection failures
Switching between local and cluster contexts
Verifying that you have a working ALB Ingress Controller
Preparing a Route 53 domain and certificate
Building and deploying ShipIt Clicker v5
Spinnaker – when and why you might need more sophisticated deployments
Introduction to Spinnaker
Setting up Spinnaker in an AWS EKS cluster using Helm
Connecting to Spinnaker through the kubectl proxy
Exposing Spinnaker via ALB Ingress Controllers
Configuring Spinnaker using Halyard
Connecting Spinnaker to Jenkins
Setting up Jenkins to integrate with both Spinnaker and ECR
Connecting Spinnaker to GitHub
Connecting Spinnaker to Docker Hub
Troubleshooting Spinnaker issues
Deploying ShipIt Clicker with a simple deployment strategy in Spinnaker
Adding a Spinnaker application
Adding a Spinnaker pipeline
Setting up a DNS entry for the Ingress Controller
Surveying Spinnaker's deployment and testing features
Canary deployments
Red/black deployments
Rolling back
Testing with Spinnaker
Summary
Further reading
Chapter 10: Monitoring Docker Using Prometheus, Grafana, and Jaeger
Technical requirements
Setting up a demo application – ShipIt Clicker v7
Docker logging and container runtime logging
Understanding Kubernetes container logging
Ideal characteristics for a log management system
Troubleshooting Kubernetes control plane issues with logs
Storing logs with CloudWatch Logs
Storing logs for the long term with AWS S3
Analyzing logs stored in S3 with AWS Athena
Using the liveness, readiness, and startup probes in Kubernetes
Using a liveness probe to see whether a container can respond
Changing ShipIt Clicker to support separate liveness and readiness probes
Exercise – forcing ShipIt Clicker to fail the readiness check
Gathering metrics and sending alerts with Prometheus
Prometheus' history
Exploring Prometheus through its query and graph web interface
Adding Prometheus metrics to an application
Querying Prometheus for a custom metric
Configuring Prometheus alerts
Sending notifications with the Prometheus Alertmanager
Exploring Prometheus queries and external monitoring in-depth
Visualizing operational data with Grafana
Gaining access to Grafana
Adding a community-provided dashboard
Adding a new dashboard with a custom query
Application performance monitoring with Jaeger
Understanding the OpenTracing API
Introduction to Jaeger
Exploring the Jaeger client with ShipIt Clicker
Installing the Jaeger Operator
Summary
Further reading
Chapter 11: Scaling and Load Testing Docker Applications
Technical requirements
Using the updated ShipIt Clicker v8
Scaling your Kubernetes cluster
Scaling the cluster manually
Scaling the cluster dynamically (autoscaling)
What is Envoy, and why might I need it?
Network traffic management with an Envoy service mesh
Setting up Envoy
Testing scalability and performance with k6
Recording and replaying network sessions
Hand-crafting a more realistic load test
Running a stress test
Summary
Further reading
Section 3: Docker Security – Securing Your Containers
Chapter 12: Introduction to Container Security
Technical requirements
Virtualization and hypervisor security models
Virtualization and protection rings
Docker and protection rings
Container security models
Docker Engine and containerd – Linux security features
PID namespaces
MNT namespaces
NET namespaces
IPC namespaces
UTS namespaces
USER namespaces
A note on cgroups
An overview of best practices
Keeping Docker patched
Securing the Docker daemon socket
Docker won't fix bad code
Always set an unprivileged user
Summary
Chapter 13: Docker Security Fundamentals and Best Practices
Technical requirements
Docker image security
Image verification
Using minimal base images
Restricting privileges
Avoiding data leakages from your image
Security around Docker commands
COPY versus ADD – what's the story?
Recursive COPY – use with caution
Security around the build process
Using multi-stage builds
Limiting resources and capabilities when deploying your builds
Limiting resources
Dropping capabilities
Summary
Chapter 14: Advanced Docker Security – Secrets, Secret Commands, Tagging, and Labels
Technical requirements
Securely storing secrets in Docker
The Raft log
Adding, inspecting, and removing secrets
Creating
Inspecting
Deleting
Secrets in action – examples
Docker tags for security
Using labels for metadata application
Summary
Chapter 15: Scanning, Monitoring, and Using Third-Party Tools
Technical requirements
Scanning and monitoring – cloud and DevOps security for containers
Scanning using Anchore Engine
A brief mention of Chef InSpec
Native monitoring locally using Docker stats
Aggregating monitoring data in the cloud with Datadog
Securing your containers using AWS
Security alerts for AWS with GuardDuty
Securing your containers using Azure
Container monitoring in Azure
Using Security Center to secure your containers in Azure
Securing your containers using GCP
Container Analysis and Binary Authorization in GCP
Understanding your attack surface with Security Command Center
Summary
Further reading
Chapter 16: Conclusion – End of the Road, but not the Journey
Technical requirements
Wrapping up – let's get started
What we learned about development
Going deeper – design patterns
Next steps for taking your DevOps knowledge further
Chaos engineering and building resilient production systems
A summary on security and where to go next
Metasploit – container-based penetration testing
Summary
Other Books You May Enjoy
Index