Difference between revisions of "Docker & Kubernetes"

From TheBestLinux.com
Jump to navigation Jump to search
 
(15 intermediate revisions by the same user not shown)
Line 157: Line 157:
 
[root@cos8minvm.dawgland.com:~]#
 
[root@cos8minvm.dawgland.com:~]#
 
</pre>
 
</pre>
 +
<br /><br />
  
 +
=== '''Installation of Docker and Docker Compose''' ===
 +
Now that you have all the prerequesits in place, and have configured the Docker-CE(CE=Community Edition, aka, the free version!), you can perform the actual installation process of dockr, docker compose and all of the related packages.
 +
<br /><br />
 +
Type this command to install all of the docker packages and tools:
 +
<pre style="color:blue">
 +
dnf install docker-ce docker-ce-cli docker-ce-rootless-extras docker-compose-plugin docker-scan-plugin containerd.io
 +
</pre>
 +
<br /><br />
  
 +
=== '''Enable the Docker Daemon/Server''' ===
 +
Type the following command to enable and start the docker server, also known as a daemon.  Once this command has been run, it should never need to be run again, unless for some reason you or someone else purposely disabled the daemon.
 +
<pre style="color:blue">
 +
[jamie@mail ~]$ sudo systemctl enable --now docker
 +
</pre>
 +
<br /><br />
  
 +
=== '''Allow your normal local user account to run docker containers, which is MUCh safter than trying to run them as the room superuser!!!''' ===
 +
<pre style="color:blue">
 +
[jamie@mail ~]$ sudo usermod -aG docker $USER
 +
</pre>
 +
<br /><br />
 +
 +
=== '''Testing Docker - Basic Functionality''' ===
 +
Perform a basic simple test of docker:
 +
<pre style="color:blue">
 +
[jamie@mail.dawgland.com:~]$ docker run hello-world
 +
Unable to find image 'hello-world:latest' locally
 +
latest: Pulling from library/hello-world
 +
719385e32844: Already exists
 +
Digest: sha256:4f53e2564790c8e7856ec08e384732aa38dc43c52f02952483e3f003afbf23db
 +
Status: Downloaded newer image for hello-world:latest
  
 +
Hello from Docker!
 +
This message shows that your installation appears to be working correctly.
 +
 +
To generate this message, Docker took the following steps:
 +
1. The Docker client contacted the Docker daemon.
 +
2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
 +
    (amd64)
 +
3. The Docker daemon created a new container from that image which runs the
 +
    executable that produces the output you are currently reading.
 +
4. The Docker daemon streamed that output to the Docker client, which sent it
 +
    to your terminal.
 +
 +
To try something more ambitious, you can run an Ubuntu container with:
 +
$ docker run -it ubuntu bash
 +
 +
Share images, automate workflows, and more with a free Docker ID:
 +
https://hub.docker.com/
 +
 +
For more examples and ideas, visit:
 +
https://docs.docker.com/get-started/
 +
 +
[jamie@mail.dawgland.com:~]$
 +
</pre>
 +
<br /><br />
 +
 +
=== How to Run an Interactive Alpine Linux Shell in a Docker Container ===
 +
Alpine Linux is a tiny distrubution of Linux, ideally suited for running in docker containers.  One major difference between Alpine Linux and most other Linux distrubtions is the default shell that it runs, as most run the BASH shell, but Alpine uses a much lighter-weight shell, the ASH shell.  This can be a "Gotcha" when attempting to run an interactive shell in an Alpine docker container.  Most docker shell commands default  using  /bin/bash as the final docker command argument, but with the Alpine container, you need to use /bin/ash, as shown here in this example of running an Alpine docker container with an interactive ASH shell.
 +
<br /><br />
 +
Type this command to start up an Alpine Linux docker container with an interactive shell:
 +
<pre style="color:blue">
 +
[jamie@mail.dawgland.com:~]$ docker run -it --rm alpine /bin/ash
 +
/ #
 +
</pre>
 +
<br /><br />
 +
Note the following sections of the command:
 +
/bin/ash is Ash (Almquist Shell) provided by BusyBox
 +
*  --rm Automatically remove the container when it exits (docker run --help)
 +
*  -i Interactive mode (Keep STDIN open even if not attached)
 +
*  -t Allocate a pseudo-TTY
 +
<br /><br />
 +
 +
After typing the above docker command, you will be at the / # prompt.  Try this command to confirm the version of Linux within the shell:
 +
<pre style="color:blue">
 +
/ # cat /etc/os-release
 +
</pre>
 +
<br /><br />
 +
 +
Note the output of the command gives the contents of the file within the /etc/os-release file inside of the running Apline Linux container OS, completely isolated from the host OS!
 +
<pre style="color:blue">
 +
NAME="Alpine Linux"
 +
ID=alpine
 +
VERSION_ID=3.18.4
 +
PRETTY_NAME="Alpine Linux v3.18"
 +
HOME_URL="https://alpinelinux.org/"
 +
BUG_REPORT_URL="https://gitlab.alpinelinux.org/alpine/aports/-/issues"
 +
/ #
 +
</pre>
 +
<br /><br />
 +
 +
=== '''Getting Docker to Work with CSF - Configure Server Firewall - My Favorite "Statefull" Firewall!''' ===
 +
By Default, Docker works with the stock "FirewallD" fireall tool included with most Red Hat based distributions of Linux, such as the required "DOCKER" IPTables Chains.  If you're like me and prefer to use a much more powerful and "Stateful" firewall tool such as CSF, the "Configure Server Firewall" freely aviable software by Way of the Web.  What I mean by "Stateful" is a "Learning" firewall, one that caretes list of the bad guys as it finds them trying to break into our servers.  There are of course black and white lists to specifically block and allow specific users and IP addresses as well.  There are other fireall tools such as PFSense, UFW, etc., I've use and had the best results with CSF.  The only issue is that if you also run Docker containers on your server, you need to manually create the DOCKER IPTables Chains.  However, I have discovered a set of really cool scripts that automate the process, located at these URL's:
 +
<br /><br />
 +
Download to the server(Docker host) and run this script first:
 +
*  [https://github.com/juli3nk/csf-pre_post_sh CSF Pre-Docker]
 +
<br />
 +
Then, download and run this one on the server:
 +
*  [https://github.com/juli3nk/csf-post-docker CSF Post-Docker]
 +
 +
<br />
 +
Be sure to run the csf-pre_post_sh script first, and then the csf-post-docker script.  You should then be able to confirm the new IPTables Chains exist using this command, run as the root superuser:
 +
<pre style="color:blue">
 +
[root@mail.jrcomputers.net:~]# iptables --list | grep -i docker
 +
DOCKER-USER  all  --  anywhere            anywhere           
 +
DOCKER-ISOLATION-STAGE-1  all  --  anywhere            anywhere           
 +
DOCKER    all  --  anywhere            anywhere           
 +
DOCKER    all  --  anywhere            anywhere           
 +
DOCKER    all  --  anywhere            anywhere           
 +
DOCKER    all  --  anywhere            anywhere           
 +
Chain DOCKER (4 references)
 +
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 +
DOCKER-ISOLATION-STAGE-2  all  --  anywhere            anywhere           
 +
DOCKER-ISOLATION-STAGE-2  all  --  anywhere            anywhere           
 +
DOCKER-ISOLATION-STAGE-2  all  --  anywhere            anywhere           
 +
DOCKER-ISOLATION-STAGE-2  all  --  anywhere            anywhere           
 +
Chain DOCKER-ISOLATION-STAGE-2 (4 references)
 +
Chain DOCKER-USER (1 references)
 +
</pre>
 +
<br /><br />
 +
If the avove comand shows all of the lines starting with DOCKER, that indicates the required IPTables firwall chains have been created, and your Docker containers should no longer have issue with networking connections and network access to the containers.
  
 
== Kubernetes ==
 
== Kubernetes ==
 
Kubernetes info coming soon...
 
Kubernetes info coming soon...

Latest revision as of 02:45, 18 August 2024

Docker

NOTICE: The following documentation refers to installation of Docker on a Red Hat Enterprise or CentOS Linux Server

Overlay Linux Kernel Driver

To begin with, Docker runs best with the "overlay2" Linux kernel driver enabled/loaded. Run this command as the root/superuser or with sudo, as seen here to enable the kernel module at each reboot: 

[jamie@cos8vm51.dawgland.com:~]$ sudo echo "overlay" > /etc/modules-load.d/overlay.conf;

Reboot and double check that the Linux kernel overlay module is loaded with this command: 

[jamie@cos8vm51.dawgland.com:~]$ lsmod | grep overlay
overlay               135168  0
[jamie@cos8vm51.dawgland.com:~]$

If you get the "overlay 135168 0" response after typing the "lsmod | grep overlay" command, you are good to go The actual number doesn't matter, as long as it shows the word "overlay", indicating the "Overlay" Linux kernel module is loaded into the kernel. If not, you need a newer Linux kernel that supports the overlay2 driver, which is beyond the scope of this article, and you basically need to pick a different newer Linux distribution.



Required Packages

Docker requires some basic utilities and tools provided by specific Linux packages. For Red Hat Enterprise Linux and CentOS Linux, these packages at minimum are required:

  • device-mapper-persistent-data
  • dnf-utils
  • fuse-overlayfs
  • lvm2
  • wget


To install these packages, or at least double check to make sure they are installed, and if not, then install them, open up a terminal if you are not already at the command prompt of the machine you want to install Docker on. Then, become the root/superuser. I use the "sudo" utility to do this, but you may have other methods depending on your system and preferences.

Here is an example of me doing so on a brand new VM(Virtual Machine) with a minimal installation of CentOS 8, fully updated using the "DNF" utility, which I will also demonstrate the command used to check for updates and refresh the package cache.


First, become the root user: 

[jamie@cos8minvm.dawgland.com:~]$ sudo su -
Last login: Tue Apr  6 19:41:31 PDT 2021 on pts/0
[root@cos8minvm.dawgland.com:~]#


And now that I am the "root", aka the "SuperUser", I will check for updates and refresh the package cache in one command: 

[root@cos8minvm.dawgland.com:~]# dnf check-update --refresh
CentOS Linux 8 - AppStream                      7.5 kB/s | 4.3 kB     00:00    
CentOS Linux 8 - BaseOS                          12 kB/s | 3.9 kB     00:00    
CentOS Linux 8 - Extras                          51  B/s | 1.5 kB     00:30    
Extra Packages for Enterprise Linux Modular 8 -  27 kB/s |  15 kB     00:00    
Extra Packages for Enterprise Linux 8 - x86_64   33 kB/s |  14 kB     00:00    
[root@cos8minvm.dawgland.com:~]#


And the actual command to install the required packages, using the DNF utility. If you are running a pre-8.x version of Red Hat Enterprise or CentOS, substitute "yum" in place of "dnf": 

[root@cos8minvm.dawgland.com:~]# dnf -y install device-mapper-persistent-data dnf-utils fuse-overlayfs lvm2 wget
Last metadata expiration check: 0:05:46 ago on Tue 06 Apr 2021 08:06:14 PM PDT.
Dependencies resolved.
================================================================================
 Package                       Arch   Version                   Repo       Size
================================================================================
Installing:
 device-mapper-persistent-data x86_64 0.8.5-4.el8               baseos    468 k
 fuse-overlayfs                x86_64 1.3.0-2.module_el8.3.0+699+d61d9c41
                                                                appstream  72 k
 lvm2                          x86_64 8:2.03.09-5.el8           baseos    1.6 M
 wget                          x86_64 1.19.5-10.el8             appstream 734 k
 yum-utils                     noarch 4.0.17-5.el8              baseos     68 k
Installing dependencies:
 device-mapper-event           x86_64 8:1.02.171-5.el8          baseos    268 k
 device-mapper-event-libs      x86_64 8:1.02.171-5.el8          baseos    267 k
 fuse3                         x86_64 3.2.1-12.el8              baseos     50 k
 fuse3-libs                    x86_64 3.2.1-12.el8              baseos     94 k
 libaio                        x86_64 0.3.112-1.el8             baseos     33 k
 lvm2-libs                     x86_64 8:2.03.09-5.el8           baseos    1.1 M
Enabling module streams:
 container-tools                      rhel8                                    

Transaction Summary
================================================================================
Install  11 Packages

Total download size: 4.7 M
Installed size: 11 M
Downloading Packages:
(1/11): device-mapper-event-1.02.171-5.el8.x86_ 644 kB/s | 268 kB     00:00    
(2/11): device-mapper-event-libs-1.02.171-5.el8 2.3 MB/s | 267 kB     00:00    
(3/11): fuse-overlayfs-1.3.0-2.module_el8.3.0+6 130 kB/s |  72 kB     00:00    
(4/11): device-mapper-persistent-data-0.8.5-4.e 3.9 MB/s | 468 kB     00:00    
(5/11): fuse3-libs-3.2.1-12.el8.x86_64.rpm      1.6 MB/s |  94 kB     00:00    
(6/11): libaio-0.3.112-1.el8.x86_64.rpm         564 kB/s |  33 kB     00:00    
(7/11): fuse3-3.2.1-12.el8.x86_64.rpm           231 kB/s |  50 kB     00:00    
(8/11): lvm2-2.03.09-5.el8.x86_64.rpm           6.2 MB/s | 1.6 MB     00:00    
(9/11): yum-utils-4.0.17-5.el8.noarch.rpm       1.2 MB/s |  68 kB     00:00    
(10/11): lvm2-libs-2.03.09-5.el8.x86_64.rpm     2.7 MB/s | 1.1 MB     00:00    
(11/11): wget-1.19.5-10.el8.x86_64.rpm          485 kB/s | 734 kB     00:01    
--------------------------------------------------------------------------------
Total                                           1.0 MB/s | 4.7 MB     00:04     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : libaio-0.3.112-1.el8.x86_64                           1/11 
  Installing       : device-mapper-event-libs-8:1.02.171-5.el8.x86_64      2/11 
  Installing       : device-mapper-event-8:1.02.171-5.el8.x86_64           3/11 
  Running scriptlet: device-mapper-event-8:1.02.171-5.el8.x86_64           3/11 
  Installing       : lvm2-libs-8:2.03.09-5.el8.x86_64                      4/11 
  Installing       : device-mapper-persistent-data-0.8.5-4.el8.x86_64      5/11 
  Installing       : fuse3-libs-3.2.1-12.el8.x86_64                        6/11 
  Running scriptlet: fuse3-libs-3.2.1-12.el8.x86_64                        6/11 
  Installing       : fuse3-3.2.1-12.el8.x86_64                             7/11 
  Installing       : fuse-overlayfs-1.3.0-2.module_el8.3.0+699+d61d9c41    8/11 
  Running scriptlet: fuse-overlayfs-1.3.0-2.module_el8.3.0+699+d61d9c41    8/11 
  Installing       : lvm2-8:2.03.09-5.el8.x86_64                           9/11 
  Running scriptlet: lvm2-8:2.03.09-5.el8.x86_64                           9/11 
  Installing       : yum-utils-4.0.17-5.el8.noarch                        10/11 
  Installing       : wget-1.19.5-10.el8.x86_64                            11/11 
  Running scriptlet: wget-1.19.5-10.el8.x86_64                            11/11 
  Verifying        : fuse-overlayfs-1.3.0-2.module_el8.3.0+699+d61d9c41    1/11 
  Verifying        : wget-1.19.5-10.el8.x86_64                             2/11 
  Verifying        : device-mapper-event-8:1.02.171-5.el8.x86_64           3/11 
  Verifying        : device-mapper-event-libs-8:1.02.171-5.el8.x86_64      4/11 
  Verifying        : device-mapper-persistent-data-0.8.5-4.el8.x86_64      5/11 
  Verifying        : fuse3-3.2.1-12.el8.x86_64                             6/11 
  Verifying        : fuse3-libs-3.2.1-12.el8.x86_64                        7/11 
  Verifying        : libaio-0.3.112-1.el8.x86_64                           8/11 
  Verifying        : lvm2-8:2.03.09-5.el8.x86_64                           9/11 
  Verifying        : lvm2-libs-8:2.03.09-5.el8.x86_64                     10/11 
  Verifying        : yum-utils-4.0.17-5.el8.noarch                        11/11 

Installed:
  device-mapper-event-8:1.02.171-5.el8.x86_64                                   
  device-mapper-event-libs-8:1.02.171-5.el8.x86_64                              
  device-mapper-persistent-data-0.8.5-4.el8.x86_64                              
  fuse-overlayfs-1.3.0-2.module_el8.3.0+699+d61d9c41.x86_64                     
  fuse3-3.2.1-12.el8.x86_64                                                     
  fuse3-libs-3.2.1-12.el8.x86_64                                                
  libaio-0.3.112-1.el8.x86_64                                                   
  lvm2-8:2.03.09-5.el8.x86_64                                                   
  lvm2-libs-8:2.03.09-5.el8.x86_64                                              
  wget-1.19.5-10.el8.x86_64                                                     
  yum-utils-4.0.17-5.el8.noarch                                                 

Complete!
[root@cos8minvm.dawgland.com:~]#


Add Docker-CE Software Repository to System

Use this command to add the Docker-CE software repository to your /etc/yum.repos.d directory. The CE in "Docker-CE" stands for "Community Edition", in case you're wondering! Having the Docker-CE yum repository allows you to easily add and remove Docker related software. Here's the command to install the "repo", as it's abbreviated: 

[root@cos8minvm.dawgland.com:~]# yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
Adding repo from: https://download.docker.com/linux/centos/docker-ce.repo
[root@cos8minvm.dawgland.com:~]#



Installation of Docker and Docker Compose

Now that you have all the prerequesits in place, and have configured the Docker-CE(CE=Community Edition, aka, the free version!), you can perform the actual installation process of dockr, docker compose and all of the related packages.

Type this command to install all of the docker packages and tools: 

dnf install docker-ce docker-ce-cli docker-ce-rootless-extras docker-compose-plugin docker-scan-plugin containerd.io



Enable the Docker Daemon/Server

Type the following command to enable and start the docker server, also known as a daemon. Once this command has been run, it should never need to be run again, unless for some reason you or someone else purposely disabled the daemon. 

[jamie@mail ~]$ sudo systemctl enable --now docker



Allow your normal local user account to run docker containers, which is MUCh safter than trying to run them as the room superuser!!!

[jamie@mail ~]$ sudo usermod -aG docker $USER



Testing Docker - Basic Functionality

Perform a basic simple test of docker: 

[jamie@mail.dawgland.com:~]$ docker run hello-world
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
719385e32844: Already exists 
Digest: sha256:4f53e2564790c8e7856ec08e384732aa38dc43c52f02952483e3f003afbf23db
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (amd64)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/

For more examples and ideas, visit:
 https://docs.docker.com/get-started/

[jamie@mail.dawgland.com:~]$



How to Run an Interactive Alpine Linux Shell in a Docker Container

Alpine Linux is a tiny distrubution of Linux, ideally suited for running in docker containers. One major difference between Alpine Linux and most other Linux distrubtions is the default shell that it runs, as most run the BASH shell, but Alpine uses a much lighter-weight shell, the ASH shell. This can be a "Gotcha" when attempting to run an interactive shell in an Alpine docker container. Most docker shell commands default using /bin/bash as the final docker command argument, but with the Alpine container, you need to use /bin/ash, as shown here in this example of running an Alpine docker container with an interactive ASH shell.

Type this command to start up an Alpine Linux docker container with an interactive shell: 

[jamie@mail.dawgland.com:~]$ docker run -it --rm alpine /bin/ash
/ #



Note the following sections of the command: /bin/ash is Ash (Almquist Shell) provided by BusyBox

  • --rm Automatically remove the container when it exits (docker run --help)
  • -i Interactive mode (Keep STDIN open even if not attached)
  • -t Allocate a pseudo-TTY



After typing the above docker command, you will be at the / # prompt. Try this command to confirm the version of Linux within the shell: 

/ # cat /etc/os-release



Note the output of the command gives the contents of the file within the /etc/os-release file inside of the running Apline Linux container OS, completely isolated from the host OS! 

NAME="Alpine Linux"
ID=alpine
VERSION_ID=3.18.4
PRETTY_NAME="Alpine Linux v3.18"
HOME_URL="https://alpinelinux.org/"
BUG_REPORT_URL="https://gitlab.alpinelinux.org/alpine/aports/-/issues"
/ #



Getting Docker to Work with CSF - Configure Server Firewall - My Favorite "Statefull" Firewall!

By Default, Docker works with the stock "FirewallD" fireall tool included with most Red Hat based distributions of Linux, such as the required "DOCKER" IPTables Chains. If you're like me and prefer to use a much more powerful and "Stateful" firewall tool such as CSF, the "Configure Server Firewall" freely aviable software by Way of the Web. What I mean by "Stateful" is a "Learning" firewall, one that caretes list of the bad guys as it finds them trying to break into our servers. There are of course black and white lists to specifically block and allow specific users and IP addresses as well. There are other fireall tools such as PFSense, UFW, etc., I've use and had the best results with CSF. The only issue is that if you also run Docker containers on your server, you need to manually create the DOCKER IPTables Chains. However, I have discovered a set of really cool scripts that automate the process, located at these URL's:

Download to the server(Docker host) and run this script first:


Then, download and run this one on the server:


Be sure to run the csf-pre_post_sh script first, and then the csf-post-docker script. You should then be able to confirm the new IPTables Chains exist using this command, run as the root superuser: 

[root@mail.jrcomputers.net:~]# iptables --list | grep -i docker
DOCKER-USER  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere            
DOCKER     all  --  anywhere             anywhere            
DOCKER     all  --  anywhere             anywhere            
DOCKER     all  --  anywhere             anywhere            
DOCKER     all  --  anywhere             anywhere            
Chain DOCKER (4 references)
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
Chain DOCKER-ISOLATION-STAGE-2 (4 references)
Chain DOCKER-USER (1 references)



If the avove comand shows all of the lines starting with DOCKER, that indicates the required IPTables firwall chains have been created, and your Docker containers should no longer have issue with networking connections and network access to the containers.

Kubernetes

Kubernetes info coming soon...

Retrieved from "https://thebestlinux.com/index.php?title=Docker_%26_Kubernetes&oldid=1515"