Docker is an open platform for Sys Admins and developers to build, ship and run distributed applications. Applications are easy and quickly assembled from reusable and portable components, eliminating the silo-ed approach between development, QA, and production environments.
Individual components can be microservices coordinated by a program that contains the business process logic (an evolution of SOA, or Service Oriented Architecture). They can be deployed independently and scaled horizontally as needed, so the project benefits from flexibility and efficient operations. This is of great help in DevOps
At a high-level, Docker is built of:
– Docker Engine: a portable and lightweight, runtime and packaging tool
– Docker Hub: a cloud service for sharing applications and automating workflows
There are more components (Machine, Swarm) but that’s beyond the basic overview I’m giving here.
Containers are lightweight, portable, isolated, self-sufficient “slices of a server” that contain any application (often they contain microservices).
They deliver on full DevOps goal:
– Build once… run anywhere (Dev, QA, Prod, DR).
– Configure once… run anything (any container).
Processes in a container are isolated from processes running on the host OS or in other Docker containers.
All processes share the same Linux kernel.
Docker leverages Linux containers to provide separate namespaces for containers, a technology that has been present in Linux kernels for 5+ years. The default container format is called libcontainer. Docker also supports traditional Linux containers using LXC.
It also uses Control Groups (cgroups), which have been in the Linux kernel even longer, to implement resources (such as CPU, memory, I/O) auditing and limiting, and Union file systems that support layering of the container’s file system.
Kernel namespaces isolate containers, avoiding visibility between containers and containing faults. Namespaces isolate:
? pid (processes)
? net (network interfaces, routing)
? ipc (System V interprocess communication [IPC])
? mnt (mount points, file systems)
? uts (host name)
? user (user IDs [UIDs])
Containers or Virtual Machines
Containers are isolated, portable environments where you can run applications along with all the libraries and dependencies they need.
Containers aren’t virtual machines. In some ways they are similar, but there are even more ways that they are different. Like virtual machines, containers share system resources for access to compute, networking, and storage. They are different because all containers on the same host share the same OS kernel, and keep applications, runtimes, and various other services separated from each other using kernel features known as namespaces and cgroups.
Not having a separate instance of a Guest OS for each VM saves space on disk and memory at runtime, improving also the performances.
Docker added the concept of a container image, which allows containers to be used on any host with a modern Linux kernel. Soon Windows applications will enjoy the same portability among Windows hosts as well.
The container image allows for much more rapid deployment of applications than if they were packaged in a virtual machine image.
Containers networking
docker0 is a virtual Ethernet bridge that automatically forwards packets between any other network interfaces that are attached to it.
For every new container, Docker creates a pair of “peer” interfaces: one “local” eth0 interface and one unique name (e.g.: vethAQI2QT), out in the namespace of the host machine.
Traffic going outside is NATted
ou can create different types of networks in Docker:
veth: a peer network device is created with one side assigned to the container and the other side is attached to a bridge specified by the lxc.network.link.
vlan: a vlan interface is linked with the interface specified by the lxc.network.link and assigned to the container.
phys: an already existing interface specified by the lxc.network.link is assigned to the container.
empty: will create only the loopback interface (at kernel space).
macvlan: a macvlan interface is linked with the interface specified by the lxc.network.link and assigned to the container. It also specifies the mode the macvlan will use to communicate between different macvlan on the same upper device. The accepted modes are: private, Virtual Ethernet Port Aggregator (VEPA) and bridge
Docker Evolution – release 1.7, June 2015
Important innovation has been introduced in the latest release of Docker, that is still experimental.
Plugins
A big new feature is a plugin system for Engine, the first two available are for networking and volumes. This gives you the flexibility to back them with any third-party system.
For networks, this means you can seamlessly connect containers to networking systems such as Weave, Microsoft, VMware, Cisco, Nuage Networks, Midokura and Project Calico. For volumes, this means that volumes can be stored on networked storage systems such as Flocker.
Networking
The release includes a huge update to how networking is done.
Recent Comments