I. Container: First Contact

1. Create your first container

A simple command

First let's run a simplest shell command: echo "Hello Docker!"

Now we run the same command again, but with Docker: docker run alpine:latest echo "Hello Docker!"

Doesn't look different in anyway, does it? That's how a container is supposed to be, just to wrap and isolate a process, without changing how the process behaves.

But what's the point of all this if running inside a container doesn't make any difference?

In the following steps we're going to run something different, to see a bit more.

2. Cgroup & PID namespace

Start a background task, for instance dd if=/dev/zero of=/dev/null &.

Then list all processes with ps -ef, as expected, you should see the task running.

Now if we list all processes in a container, will you still see it? docker run alpine:latest ps -ef

This ability of process isolation is achieved by means of the cgroups feature. A process running inside a container is isolated in its own group, meaning it cannot see processes outside the group.

(From Wikipedia)

cgroups (abbreviated from control groups) is a Linux kernel feature that limits, accounts for, and isolates the resource usage (CPU, memory, disk I/O, network, etc.) of a collection of processes.

3. File system

This time we cat the contents in our /etc/passwd file: cat /etc/passwd

Then we do the same in a container: docker run alpine:latest cat /etc/passwd

You guessed right, the results differ. A container has its own file system, again, isolated:

df

docker run alpine:latest df

Generally speaking, changes we make in a container won't affect the state on the host. This is with some exception, for instance the Volume feature, which we'll cover later.

4. Network namespace

Last but not least, the network.

For comparison, run hostnamectl to see our current host name, although I think you already see it in the command line prompt.

Then we take a look at how it is in a container: docker run alpine:latest hostname

A container has its own host name, which by default is a random hash string (a unique ID of the container). That sounds like an isolated network namespace, doesn't it? Here's how you can see more evidences of that:

ip add

docker run alpine:latest ip add

netstat

docker run alpine:latest netstat

(From Wikipedia)

Network namespaces virtualize the network stack. On creation a network namespace contains only a loopback interface.

Each namespace will have a private set of IP addresses, its own routing table, socket listing, connection tracking table, firewall, and other network-related resources.

cd <directory>	Change directory
ls	List directory
echo 'contents' > <file>	Write contents to a file
cat <file>	Output contents of file

i	In Command Mode	Change into Insert Mode, you can now insert and edit text in the file
esc	In Insert Mode	Change into Command Mode, you can now execute commands
:wq	In Command Mode	Save and Exit

Welcome!

Congratulations!

You've completed the scenario!

Scenario Rating

Steps