Remain the King in your Container Empire - JUG Saxony Day€¦ · King in Container Empire Access...

Remain the King in your Container EmpireBernd Fischer

Remain the King in your Container Empire

King in Container Empire

Passionate Java Developer (especially Spring)Python, Go-Lang

Agile and Devops infectedContainer enthusiast

berndfischer63@gmail.com@berndfischer63

JUG Saxony e.V., Docker Community Dresden

CTO MindApproach GmbH, Dresdenbfischer@mindapproach.de

Intro - Who’s that guy?

King in Container EmpireIntro - Who’s that guy?

Disclaimer ….

King in Container EmpireIntro - Objectives

❏ it’s not an intro - you need some knowledge about (Docker) container and linux❏ see: talk/slides JUG Saxony Day 2015

King in Container EmpireIntro - Experience ??? - Projects ???

https://pixabay.com/en/cloud-weather-forecast-weather-sky-346710/

https://pixabay.com/en/ship-shipwreck-adventure-setting-1366926/

https://pixabay.com/en/container-shipping-freight-147973/https://pixabay.com/en/shipwreck-ship-abandoned-carnage-575907/

❏ you need some knowledge about (Docker) container and linux - it’s not an intro❏ see: talk/slides JUG Saxony Day 2015

❏ lessons learned since 2015 from and for production

❏ from and for daily business of a Java developer

❏ trouble shooting / debugging

https://pixabay.com/en/crown-golden-royal-shining-shiny-312734/

First Lesson

King in Container EmpireFirst Lesson

http://m.memegen.com/efxili.jpg

Fix issues locally before they hit production

King in Container EmpireFirst Lesson

ContinuousEnvironment

by myself

as possible as identical from dev to prd

Demo Application

King in Container EmpireDemo Application

Linux (Ubuntu 18.04-LTS/Alpine)

java -jar ...

urlusernamepassword

Demo-ApplicationSpring Boot Webembedded Tomcat Database

King in Container EmpireDemo Application

Second LessonAccessing Internal Services

King in Container EmpireAccess Internal Services

SSH-Server

SSH tunnel

# demo-helloworld-web bf$

docker service create --name=sshd --replicas=1 \ --publish="7777:22" \ registry.gitlab.com/aemc/dockerims/sshd:20180927T130729

docker secret create id_rsa_user.pub.v1 $DMO_PUB_KEY

# care about formattingdocker service update \ --secret-add source=id_rsa_user.pub.v1,target= /home/user/.ssh/authorized_keys, mode=0640,uid=1000,gid=1000 \ sshd

# choose targetexport DMO_SERVICE_NAME=hw_dmo_mysql

# choose network of serviceDMO_NETWORK_ID=\$(docker service inspect $DMO_SERVICE_NAME |\jq -r .[0].Spec.TaskTemplate.Networks[0].Target)

# get name of networkdocker network inspect $DMO_NETWORK_ID | jq -r .[0].Name

docker service update --network-add $DMO_NETWORK_ID sshd

...entrypoint: - "java" - "-agentlib:jdwp=transport=dt_socket,server=y, suspend=n,address=*:7777" - "-jar" - "demo-helloworld-web.jar"...

=> service re-creation necessary no change of Docker images necessary

# check service start commanddocker service inspect hw_dmo_app | jq .[0].Spec.TaskTemplate.ContainerSpec.Command

my-ssh -i $DMO_PRV_KEY user@d4r-cluster01-m01.aemc.me \ -p 7777 -L 12345:app:7777# stays open ...

Third LessonAccess Local Services

King in Container EmpireAccess Local Services

Not in this demo

poor man’s "ngrok"

# additional port to be reachable from "outside world"docker service update sshd --publish-add 2345:2345

# start helloworld-web app in IDE# listen on port 8080

my-ssh -i ~/.ssh/id_rsa_dmo -p 7777 \user@d4r-cluster01-m01.aemc.me \-R 2345:localhost:8080

# open browser# http d4r-cluster01-m01.aemc.me:2345

Fourth Lesson"From Scratch" Docker Images

King in Container EmpireFrom Scratch Docker Images

❏ Docker Image best practice❏ as small as possible to

❏ save bandwidth and storage❏ reduce attack vectors

❏ Result: Docker images ❏ based on “small” linux distributions like Alpine and

similar❏ with static linked binaries and no base linux distro

❏ Consequences:❏ missing tools for debugging ...❏ may not work:

docker container exec …

FROM golang:alpine AS builder

ADD ./whoami.go /go/srcENV GOOS=linuxENV GOARCH=386RUN cd /go/src && go build -o /go/bin/whoamiRUN echo "Hallo from GoWebServer" > /go/bin/index.html

FROM scratch | FROM alpineWORKDIR /appCOPY --from=builder /go/bin/whoami /app/COPY --from=builder /go/bin/index.html /app/src/ENTRYPOINT [ "./whoami" ]

two images

docker service create \ --name=whoami-alpine \ --replicas=1 \ --publish="9876:8000" \ --hostname=whoami_alpine \ --constraint "node.role == worker" \ aemc/whoami:alpine

http d4r-cluster01-m01.aemc.me:9876http d4r-cluster01-m01.aemc.me:9876/pinghttp d4r-cluster01-m01.aemc.me:9876/whoami

docker service create \ --name=whoami-scratch \ --replicas=1 \ --publish="1234:8000" \ --hostname=whoami_scratch \ --constraint "node.role == worker" \ aemc/whoami:scratch

http d4r-cluster01-m01.aemc.me:1234http d4r-cluster01-m01.aemc.me:1234/pinghttp d4r-cluster01-m01.aemc.me:1234/whoami

./get-containerids-of-service.sh whoami-alpine# container runs an node ???

$(setDockerEnv.sh d4r <node>.aemc.me)

docker info | grep -i name

docker container exec -it <container> sh/app # cat src/index.htmlHallo from GoWebServer/app # exit

$(setDockerEnv.sh d4r d4r-cluster01-m01.aemc.me)

./get-containerids-of-service.sh whoami-scratch# container runs an node ???export CON_ID=<container>

$(setDockerEnv.sh d4r <node>.aemc.me)

docker info | grep -i name

docker container exec -it $CON_ID sh...

# use a second "container" with necessary tools …

docker container run -it --rm \ --net container:$CON_ID \ --pid container:$CON_ID \ alpine sh/ # id/ # ps auxww/ # nc localhost 8000GET / HTTP/1.1host: localhost

# use a second "container" with necessary tools …# continue ..

/ # ls -al /proc/1/root// # cat -al /proc/1/root/app/src/index.html/ # echo "Hallo from GoWebServer - Changed1" > \ /proc/1/root/app/src/index.html

# use browser

/ # exit

❏ mission accomplished ;-)❏ able to "enrich" "reduced images" Docker

images with additional functionality❏ right now only for linux container ...

Fifth LessonResource Limits and Container Awarness

King in Container EmpireResource Limits

❏ Fokus for now: memory❏ Java 8 u131❏ Sources:

❏ docker-java-memory-limits (see links)❏ => Demo

❏ MemoryInfo.java❏ MemoryEater.java

❏ Prepared Docker image❏ registry.gitlab.com/aemc/eval/

docker-java-memory-limits❏ Hint: using VM’s with 2 GB RAM ...

export IMG=registry.gitlab.com/aemc/eval/ docker-java-memory-limits

docker container run --rm --name=test \ $IMG MemoryTotal

docker container run --rm --name=test --memory 100MB \ $IMG MemoryTotal

docker container run --name=test --memory 100MB \ $IMG MemoryEater

docker container ls -a --filter="name=test"# exited with 137 -> SIG_KILL

docker container inspect test | jq .[0].State# ExitCode: 137# OOMKilled: true

docker container rm test

docker container run --rm -m 100MB --name=test \ $IMG -Xmx100M MemoryTotal

# use helper/start script for computation# https://github.com/fabric8io-images/java/blob/master/# images/alpine/openjdk8/jre/run-java.sh

docker container run --rm --memory 1GB --name=test \ $IMG \ -XX:+UnlockExperimentalVMOptions \ -XX:+UseCGroupMemoryLimitForHeap \ MemoryTotal

Some more lessons ...

King in Container EmpireSome more lessons ...

❏ Use container together with automation tools like Ansible, Puppet, Salt, … to❏ fill gaps

❏ secret/config handling❏ local volume handling

❏ guarantee reproducibility❏ improve flexibility❏ improve automation

King in Container EmpireSome more lessons ...

❏ Security … ❏ using Docker/K8s/… CLI => root !!!❏ use RBAC mechanism

❏ Docker Auth-Plugins❏ Caspbin (https://github.com/casbin/casbin)❏ Authobot (https://github.com/ndeloof/authobot)

❏ UI❏ Docker EE❏ Portainer❏ ...

King in Container EmpireSome more lesson ...

Questions …?

King in Container EmpireLinks

❏ Source Code❏ https://gitlab.com/aemc

❏ demo/demo-helloworld-web❏ demo/demo-multi-swarm-cluster❏ demo/demo-swarm-cluster❏ aemc/eval/docker-java-memory-limits

❏ Java Resource Limits❏ https://bugs.openjdk.java.net/browse/JDK-8182070❏ https://bugs.openjdk.java.net/browse/JDK-8146115

King in Container Empire

This is the last slide ...

Remain the King in your Container Empire - JUG Saxony Day€¦ · King in Container Empire Access...

Documents

Empire Francais Amerique

Déchargement du container en HAÏTI

Construire Sa Maison Container - Eyrolles

Empire ottoman -- Histoire

Tout Empire périra

L' Empire Romain

EMPIRE T'AU

Un Porte Container

GIS Container

Le container - Cellules Baikal

ACROPOLIS CONTAINER SERVICES

Van Tai Bien Container Vinafco

OpenShift Container Platform 企業級容器化DevOps平台 · 2017-03-23 · container container container container container networking storage registry security logs & metrics

Le Saint Empire

dossier Container janv 19

smurfit stone container 3Q07_Release_FR

Container - februe.de · 109 Container Container – passend zum Tisch, mobil und belastbar, organisierbar und abschließbar: Ordnung mit System. Pedestals – tomatch the desk

Construire Sa Maison Container.2éme.Édition

Container Store 10Q

Construire sa maison container