What is Docker Compose?

Docker Compose is a tool used to define and manage multi-container Docker applications. Instead of managing each container individually, Docker Compose allows you to describe an entire application’s services, networks, and volumes in a single YAML file. This configuration file makes it easy to set up, manage, and orchestrate a complex environment involving multiple containers.

The primary benefit of Docker Compose is its ability to simplify the management of complex applications that consist of multiple containers, such as web servers, databases, and caches, which are all needed to run an application effectively. Docker Compose helps in the development, testing, and deployment of these containerized applications in an automated and reproducible manner.

Key Features of Docker Compose:

• Multi-container environments: It allows you to define multiple containers in a single configuration file, and then manage them collectively as one application.
• Isolation and Environment Management: Docker Compose helps in managing containerized environments by isolating them, so you can easily spin up environments for different stages of application development.
• Easy Setup and Orchestration: It provides a simple way to set up and run applications in isolated environments, ensuring the necessary dependencies are configured correctly.

With Docker Compose, developers can take advantage of Docker’s containerization benefits but at a higher level of abstraction, making it easier to handle complex microservices-based applications.

What are the Major Use Cases of Docker Compose?

Docker Compose is used widely in scenarios that involve multi-container applications. Here are the major use cases for Docker Compose:

1. Microservices Architecture
   One of the most popular use cases of Docker Compose is in the context of microservices architecture. Microservices often consist of multiple components that communicate with each other over a network. Docker Compose is perfect for this type of architecture because it allows developers to define all the necessary components (e.g., a web server, database, message queue) in one place. Each of these services can be packaged in its own container, and Docker Compose ensures that they are correctly orchestrated and connected.
2. Development and Testing Environments
   Docker Compose is an excellent tool for setting up development and testing environments. Developers can use it to create a local environment that mirrors production, with all the necessary services like databases, caches, and web servers. With a simple command, developers can spin up the entire stack with the exact versions of services they need, enabling consistency across different stages of development. Testing environments can also be isolated in Docker Compose, ensuring that tests are run in the correct environment without polluting the local machine.
3. Continuous Integration (CI) and Continuous Delivery (CD)
   Docker Compose is commonly used in CI/CD pipelines, where it helps automate the deployment and testing of applications. Using Docker Compose, developers can create an isolated environment for testing code changes with services that are as close to the production environment as possible. By defining the environment in a docker-compose.yml file, teams can ensure that the exact setup used for development and testing is replicated in the CI/CD pipeline.
4. Local Development of Web Applications
   For local development, Docker Compose makes it easy to create full-stack web applications. Developers often need services such as databases, web servers, caching, and more. Instead of installing and configuring each of these services manually, Docker Compose allows you to define them in a single YAML file. This ensures the development environment is simple to set up and can be easily replicated by other team members.
5. Legacy Application Modernization
   Docker Compose can be helpful when modernizing legacy applications that were originally built with a monolithic architecture. By breaking down the components into separate containers (e.g., the front-end, database, and other services), Docker Compose can be used to orchestrate the communication between these containers. This allows organizations to gradually transition from a monolithic setup to a microservices-based architecture without a complete overhaul of the system.

How Docker Compose Works Along with Architecture?

Docker Compose operates in a client-server architecture, where the user interacts with Docker Compose commands through the command-line interface (CLI), and Docker Compose orchestrates the setup and management of containers using the Docker Engine. It uses a declarative YAML configuration file (docker-compose.yml) to define the services and their interactions. Let’s explore how Docker Compose fits into system architecture.

1. Docker Compose File (docker-compose.yml)
   The docker-compose.yml file is the heart of Docker Compose. It defines the services, networks, and volumes needed for your application. Each service is configured with its image, build context, environment variables, ports, and dependencies on other services. A typical file might look like this: version: '3' services: web: image: webapp:latest ports: - "8080:80" db: image: postgres:latest environment: POSTGRES_PASSWORD: example In this example, there are two services defined: a web application service and a database service. The web service uses an image of a web application, and the db service uses a PostgreSQL image with a defined environment variable.
2. Orchestrating Containers
   Docker Compose interacts with the Docker Engine to create and manage containers as defined in the docker-compose.yml file. The Compose file describes how each container should be configured (such as environment variables, volumes, and networking). When a user runs docker-compose up, Docker Compose reads this configuration, downloads the necessary images (if not available locally), creates containers, and starts them in the correct order.
3. Networking Between Services
   Docker Compose sets up an isolated network for the containers defined in a Compose file. Containers can communicate with each other via the container names or service names defined in the Compose file. For instance, the web service can access the database service using the hostname db (the name of the service defined in the Compose file). This ensures that services can interact in a predictable and isolated way without interfering with the host system or other applications.
4. Volumes for Data Persistence
   In a Docker Compose setup, containers often need to persist data. Docker Compose allows you to define volumes in the docker-compose.yml file, ensuring that data is saved between container restarts. For example, a volume could be used to store database data so that it persists even after the database container is stopped or recreated.
5. Scaling Services
   Docker Compose can be used to scale services up or down by specifying the number of replicas (containers) for a service. This is particularly useful in development and testing environments where you need to simulate multiple instances of a service to test scalability.

Basic Workflow of Docker Compose

The basic workflow of Docker Compose revolves around creating a docker-compose.yml file and using a set of simple commands to manage your containers. Here’s the basic workflow for getting started with Docker Compose:

1. Define Services in a Compose File
   Start by defining the services you need for your application in a docker-compose.yml file. Each service corresponds to a container, and you’ll specify its configuration, such as the image to use, build context, environment variables, ports, and volumes.
2. Build and Start Containers
   Use the docker-compose up command to build and start all the services defined in the docker-compose.yml file. This command reads the configuration, pulls images (if needed), creates containers, and starts them. You can also run docker-compose up -d to start the containers in detached mode (in the background).
3. Scale Services
   If your application requires multiple instances of a service (e.g., for load balancing), you can scale services using the --scale flag. For example, to run 3 instances of the web service, you can use: docker-compose up --scale web=3
4. Monitor and Manage Containers
   Once the containers are running, you can use docker-compose ps to list the containers, docker-compose logs to view logs, and docker-compose exec to run commands inside running containers.
5. Stopping and Removing Containers
   After you’re done, you can stop and remove the containers with docker-compose down. This stops all running containers, removes them, and cleans up networks and volumes that were created during the lifecycle of the services.

Step-by-Step Getting Started Guide for Docker Compose

To get started with Docker Compose, follow this simple guide:

Step 1: Install Docker and Docker Compose

• Docker: First, ensure Docker is installed on your machine. Follow the installation instructions for your operating system from the Docker website.
• Docker Compose: Docker Compose is included with Docker Desktop, but if you are using Linux or a minimal installation, you may need to install Docker Compose separately. Follow the Docker Compose installation guide to get started.

Step 2: Create a docker-compose.yml File

Create a docker-compose.yml file that defines your services. For example:

version: '3'
services:
  web:
    image: nginx
    ports:
      - "8080:80"

Step 3: Start Your Application

Run the following command to start your application:

docker-compose up

Step 4: Scale Services (Optional)

If you want to scale your services, use the --scale flag:

docker-compose up --scale web=3

Step 5: Monitor and Interact with Your Containers

You can interact with the running containers using:

docker-compose ps
docker-compose logs
docker-compose exec web /bin/bash

Step 6: Shut Down and Clean Up

Once you’re finished, you can stop and remove your containers with:

docker-compose down

The post Mastering Docker Compose: Use Cases, Architecture, and Workflow appeared first on scmGalaxy.

What is NGINX Proxy?

NGINX Proxy is a highly efficient reverse proxy and load balancer server used to manage web traffic and distribute it across multiple backend servers. NGINX (pronounced “Engine-X”) is well-known for its high performance, scalability, and reliability. It is often used in production environments to serve static files, handle dynamic requests, and proxy HTTP/HTTPS traffic to backend services like web servers, application servers, or even microservices.

In the context of a reverse proxy, NGINX Proxy acts as an intermediary between clients (users’ browsers or APIs) and one or more backend servers. It receives requests from clients and forwards them to the appropriate backend server, ensuring that the traffic is efficiently routed.

Major Use Cases of NGINX Proxy

NGINX Proxy is highly versatile, serving a wide array of use cases:

1. Load Balancing

• Distribute Requests Across Servers: NGINX Proxy can evenly distribute incoming requests across multiple servers, preventing any one server from becoming overloaded.
• Enhance Availability: By balancing traffic between multiple instances, NGINX ensures high availability and improved fault tolerance.

2. Reverse Proxy for Web Servers

• Forward Requests to Backend Servers: NGINX acts as a reverse proxy by forwarding client requests to backend web servers (like Apache or application servers), ensuring that only one point of contact is exposed to the client.
• TLS Termination: It handles TLS/SSL encryption for HTTPS traffic, offloading the work from backend servers and improving performance.

3. Caching

• Improved Performance: NGINX Proxy can cache content (static files, API responses, etc.) at the edge, reducing the load on backend servers and improving the response time.
• Cache Control: You can control how long certain content stays in the cache, enabling more efficient use of resources.

4. Security & Access Control

• Hide Backend Servers: By acting as a reverse proxy, NGINX Proxy hides the details of backend infrastructure from the outside world, adding a layer of security.
• Access Restriction: NGINX Proxy can restrict access to certain backend resources based on IP, URL, or other parameters.

5. API Gateway for Microservices

• Manage Microservices Traffic: In microservices architectures, NGINX Proxy can serve as an API Gateway, managing requests and routing them to appropriate microservices.
• Centralized Authentication and Logging: It handles authentication (like OAuth2 or JWT), request logging, and rate limiting across microservices.

How NGINX Proxy Works (Architecture Overview)

The architecture of NGINX Proxy revolves around request handling, traffic distribution, and security management. Here’s a breakdown of its components and workflow:

Key Components of NGINX Proxy:

1. NGINX Server:
   • The NGINX Proxy server receives all incoming HTTP/S traffic and directs it based on configuration to one or more backend servers.
   • NGINX can serve static files (like images, HTML, CSS, etc.) and pass dynamic content requests to backend servers like PHP, Python, or Node.js.
2. Backend Servers:
   • These are the servers where your web applications or APIs are hosted. NGINX Proxy routes requests to these servers, which process the requests and return the response to NGINX.
3. Load Balancing Mechanism:
   • NGINX supports multiple load balancing algorithms, including round-robin, least connections, and IP-hash. These algorithms determine how incoming requests are distributed across multiple backend servers.
4. TLS Termination:
   • NGINX Proxy handles SSL/TLS encryption and decryption for secure HTTPS traffic, offloading this computationally expensive task from the backend servers.
5. Caching Layer:
   • NGINX Proxy can cache responses from backend servers, reducing the number of requests that need to be processed and improving response times for frequently requested resources.
6. Access Control & Security:
   • NGINX Proxy provides robust features for managing access, including restricting traffic from certain IP addresses, applying rate limits, and blocking malicious traffic.

NGINX Proxy Flow:

1. Request Reception: The client makes an HTTP request (e.g., for a webpage or API).
2. DNS Resolution: The domain name is resolved to the IP of the NGINX Proxy server.
3. Routing & Load Balancing: NGINX Proxy evaluates the request, possibly using load balancing algorithms to route it to one of several backend servers.
4. SSL/TLS Termination: If the request is HTTPS, NGINX Proxy terminates the SSL/TLS handshake and decrypts the data.
5. Request Forwarding: NGINX forwards the request to the appropriate backend server.
6. Response: The backend server processes the request and returns a response to NGINX.
7. Caching (Optional): NGINX Proxy may cache the response and send it back to the client, reducing future load on the backend.
8. Client Response: NGINX sends the response back to the client.

Basic Workflow of NGINX Proxy

The basic workflow of NGINX Proxy involves:

1. Configuration Setup:
   • Define upstream servers (backend servers) and proxy rules.
   • Configure load balancing, SSL termination, and caching.
2. Traffic Reception:
   • NGINX Proxy receives incoming client requests on specified ports (usually HTTP 80 and HTTPS 443).
3. Request Routing:
   • NGINX Proxy checks the request headers, including the host and path, to determine which backend server should handle the request.
4. Handling Response:
   • After receiving the response from the backend server, NGINX Proxy may perform additional actions like caching, compression, or content rewriting.
5. Response Delivery:
   • The response is delivered back to the client, potentially utilizing caching to speed up future requests.

Step-by-Step Getting Started Guide for NGINX Proxy

Prerequisites:

• Basic understanding of Docker and NGINX.
• Docker and Docker Compose installed.

Step 1: Set Up Docker Environment

1. Install Docker and Docker Compose on your system if not already installed.
2. Create a docker-compose.yml file for the NGINX Proxy container and your backend services:

version: '3'
services:
  nginx-proxy:
    image: jwilder/nginx-proxy
    container_name: nginx-proxy
    environment:
      - DEFAULT_HOST=default.local
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro

  webapp:
    image: your-web-app-image
    environment:
      - VIRTUAL_HOST=webapp.example.com
      - VIRTUAL_PORT=80
    expose:
      - "80"

Step 2: Launch NGINX Proxy

Start the services using Docker Compose:

docker-compose up -d

This will start NGINX Proxy and your backend web application container.

Step 3: Test the Reverse Proxy

Once the containers are running, navigate to http://webapp.example.com in your browser. NGINX Proxy should route the request to the webapp container, and the application should respond.

Step 4: Set Up SSL (Optional)

To enable SSL using Let’s Encrypt, you can add environment variables for SSL certificate management:

  nginx-proxy:
    image: jwilder/nginx-proxy
    container_name: nginx-proxy
    environment:
      - VIRTUAL_HOST=webapp.example.com
      - LETSENCRYPT_HOST=webapp.example.com
      - LETSENCRYPT_EMAIL=your-email@example.com
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro

The post NGINX Proxy: Optimizing Web Traffic and Enhancing Performance appeared first on scmGalaxy.

1. Native Docker
2. cAdvisor
3. Scout
4. Pingdom
5. Datadog
6. Sysdig
7. Prometheus
8. Heapster / Grafana
9. ELK stack
10. Sensu

Reference

https://rancher.com/comparing-10-container-monitoring-solutions-rancher/

The post Top 10 Container(Docker) Monitoring Solutions and Tools in 2018 appeared first on scmGalaxy.

By default docker use https to connect to docker registry. But there can be use cases to use insecure registry. Here are the steps to use insecure registry.

In ubuntu
edit the file /etc/default/docker and update DOCKER_OPTS e.g

DOCKER_OPTS='--insecure-registry 10.84.34.155:5000'

where 10.84.34.155 is ipaddress of registry and 5000 is your port on which registry is configured.

In Centos
Edit the file /etc/docker/daemon.json e.g.

{
"insecure-registries" : ["10.84.34.155:5000"]
}

where 10.84.34.155 is ipaddress of registry and 5000 is your port on which registry is configured.

Restart docker
$ service docker restart

The post Setup Docker service to use insecure(http) registry instead of https appeared first on scmGalaxy.

As of Version 0.12.0, Docker supports PAUSE and UNPAUSE commands to pause and resume containers using cgroup freezer.

The docker pause command suspends all processes in the specified containers. On Linux, this uses the cgroups freezer. Traditionally, when suspending a process the SIGSTOP signal is used, which is observable by the process being suspended. With the cgroups freezer the process is unaware, and unable to capture, that it is being suspended, and subsequently resumed. On Windows, only Hyper-V containers can be paused.

So it means that the processes in the container stop running, and they are able to be resumed later.

Possible use is to pause resource intensive tasks that you can resume at a later date. Some people predict that “docker pause” could be used in the future to support “live” migration of containers between Docker Engines.

Checkout more about cgroups freezer here https://www.kernel.org/doc/Documentation/cgroup-v1/freezer-subsystem.txt

[root@ip-172-31-80-30 ~]# docker run -d -p 8080:8080 -p 50000:50000 jenkins

[root@ip-172-31-80-30 ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
6be033bf1f69 jenkins "/bin/tini -- /usr/l…" About an hour ago Up About an hour (Paused) 0.0.0.0:8080->8080/tcp, 0.0.0.0:50000->50000/tcp laughing_bell

[root@ip-172-31-80-30 ~]# docker pause 6be033bf1f69
Error response from daemon: Container 6be033bf1f6917f3bfcccd5d770c00349c47576ab1cd77b14aa39ef1333ae90c is already paused

[root@ip-172-31-80-30 ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
6be033bf1f69 jenkins "/bin/tini -- /usr/l…" About an hour ago Up About an hour (Paused) 0.0.0.0:8080->8080/tcp, 0.0.0.0:50000->50000/tcp laughing_bell

[root@ip-172-31-80-30 ~]# docker exec -it 6be033bf1f69 /bin/bash
Error response from daemon: Container 6be033bf1f69 is paused, unpause the container before exec

[root@ip-172-31-80-30 ~]# docker top 6be033bf1f69
UID PID PPID C STIME TTY TIME CMD
ec2-user 23703 23691 0 13:26 ? 00:00:00 /bin/tini -- /usr/local/bin/jenkins.sh
ec2-user 23724 23703 0 13:26 ? 00:00:23 java -jar /usr/share/jenkins/jenkins.war

The post docker pause and unpause explanined! appeared first on scmGalaxy.

We need to carefully understand the life cycle of Docker containes. There are following images which depicts the the right phases of docker containers.

Phase of Docker Containers

• Create -> Destroy
• Create -> Start -> Stopped -> Destroy
• Create -> Start -> Pause -> Unpause
• Create -> Start -> Restart

Image flow of Simple Docker Container Lifecycle

Image flow of Detailed Docker Container Lifecycle

Image Source and Credits: http://docker-saigon.github.io/post/Docker-Internals/

Create container
$ docker create –name ubuntu-cont ubuntu

Run docker container
$ docker run -itd ubuntu
$ docker run -itd –name ubuntu-cont ubuntu

Pause container
$ docker pause <container-id/name>

Unpause container
$ docker unpause <container-id/name>

Start container
$ docker start <container-id/name>

Stop container
$ docker stop <container-id/name>

Restart container
$ docker restart <container-id/name>

Kill container
$ docker kill <container-id/name>

Destroy container
$ docker rm <container-id/name>

The post Lifecycle of Docker Containers appeared first on scmGalaxy.

Port expose and publish has to happen when a container is created. Just stop the existing container and create a new one in its place with the added expose and/or publish options.

By default Docker containers can make connections to the outside world, but the outside world cannot connect to containers. Each outgoing connection will appear to originate from one of the host machine’s own IP addresses thanks to an iptables masquerading rule on the host machine that the Docker server creates when it starts:

$ sudo iptables -t nat -L -n
...
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.17.0.0/16 0.0.0.0/0

The Docker server creates a masquerade rule that lets containers connect to IP addresses in the outside world. If you want containers to accept incoming connections, you will need to provide special options when invoking docker run. There are two approaches.

How to map ports to containers?
Approach 1
First, you can supply -P or –publish-all=true|false to docker run
or
EXPOSE line in the image’s Dockerfile
or
–expose <port> commandline flag and maps it to a host port somewhere within an ephemeral port range.

Approach 2
Mapping can be specified explicitly using -p SPEC or –publish=SPEC option. It allows you to particularize which port on docker server – which can be any port at all, not just one within the ephemeral port range – you want mapped to which port in the container.

How to EXPOSE Port on running container?

Mehtod 1 – Using docker commit
Commit your current container to a new image and then do a docker run specifying the new port range and the new image name.

$ docker stop containerID 
$ docker commit containerID newImageName:tag
$ docker run -d --name db -p 8091-8094:8091-8094 -p 11210:11210 newImageName:tag

Method 2 – using iptables

HOST> iptables -t nat -A DOCKER -p tcp --dport 443 -j DNAT --to-destination 172.17.0.2:443
HOST> iptables -t nat -A POSTROUTING -j MASQUERADE -p tcp --source 172.17.0.2 --destination 172.17.0.2 --dport https
HOST> iptables -A DOCKER -j ACCEPT -p tcp --destination 172.17.0.2 --dport https

The post Working with Ports in Docker Containers appeared first on scmGalaxy.

What is SELinux and how its SELinux used in Docker?

There are three popular solutions for implementing access control in Linux:

1. SELinux
2. AppArmor
3. GrSecurity

Security-Enhanced Linux (SELinux) is a Linux kernel security module that provides a mechanism for supporting access control security policies. It is a security feature of the Linux kernel. It is designed to protect the server against misconfigurations and/or compromised daemons. It put limits and instructs server daemons or programs what files they can access and what actions they can take by defining a security policy.

SELinux is an implementation of a MAC security mechanism. MAC is an acronym for Mandatory Access Control (MAC). It is built into the Linux kernel and enabled by default on Fedora, CentOS, RHEL and a few other Linux distributions. SELinux allows server admin to define various permissions for all process. It defines how all processes can interact with other parts of the server such as:

• Pipes
• Files
• Network ports
• Sockets
• Directories
• Other process

SELinux puts restrictions on each of the above object according to a policy. For example, an apache user with full permission can only access /var/www/html directory, but can not touch other parts of the system such as /etc directory without policy modification. If an attacker managed to gain access to sendmail mail or bind dns or apache web server, would only have access to exploited server and the files normally has access as defined in the policy for the server. An attacker can not access the other parts of the system or internal LAN. In other words, damage can be now restricted to the particular server and files. The cracker will not able to get a shell on your server via common daemons such as Apache / BIND / Sendmail as SELinux offers the following security features:

• Protect users’ data from unauthorized access.
• Protect other daemons or programs from unauthorized access.
• Protect network ports / sockets / files from unauthorized access.
• Protect server against exploits.
• Avoid privilege escalation and much more.

Please note that SELinux is not a silver bullet for protecting the server. You must follow other security practices such as

• Implementing firewalls policy.
• Server monitoring.
• Patching the system on time.
• Writing and securing cgi/php/python/perl scripts.

The /etc/selinux/config configuration file controls whether SELinux is enabled or disabled, and if enabled, whether SELinux operates in permissive mode or enforc-ing mode.

SETTING OF SELINUX
SELinux is set in three modes.

Enforcing – SELinux security policy is enforced. IF this is set SELinux is enabled and will try to enforce the SELinux policies strictly

Permissive – SELinux prints warnings instead of enforcing. This setting will just give warning when any SELinux policy setting is breached

Disabled – No SELinux policy is loaded. This will totally disable SELinux policies.

SELinux policies
SELinux allows for multiple policies to be installed on the system, but only one policy may be active at any given time. At present, two kinds of SELinux policy exist:

Targeted – The targeted policy is designed as a policy where most processes operate without restrictions, and only specific ser-vices are placed into distinct security domains that are confined by the policy.

Strict – The strict policy is designed as a policy where all processes are partitioned
into fine-grained security domains and confined by policy.

To put SELinux into enforcing mode:

$ sudo setenforce 1

To query the SELinux status:

$ getenforce

To see SELinux status in simplified way you can use sestatus

$ sestatus

To get elobrated info on difference status of SELinux on different services use -b option along sestatus

$ sestatus -b

How to disable SElinux?

We can do it in two ways
1)Permanent way : edit /etc/selinux/config
change the status of SELINUX from enforcing to disabled
SELINUX=enforcing
to
SELINUX=disabled
Save the file and exit.

2)Temporary way : Execute below command
echo 0 > /selinux/enforce
or
setenforce 0

How about enabling SELinux?

1)Permanent way : edit /etc/selinux/config
change the status of SELINUX from disabled to enforcing
SELINUX=disabled
to
SELINUX=enforcing
Save the file and exit.

2)Temporary way : Execute below command
echo 1 > /selinux/enforce
or
setenforce 1

Now lets understand Docker with SELinux?
The interaction between SELinux policy and Docker is focused on two concerns: protection of the host, and protection of containers from one another.

SELinux labels consist of 4 parts:

User:Role:Type:level.

SELinux controls access to processes by Type and Level. Docker offers two forms of SELinux protection: type enforcement and multi-category security (MCS) separation.

Docker has the –selinux-enabled flag by default in CentOS 7.4.1708. However, in case your image or your configuration management tool is disabling it, as was the case for our puppet module verify this, you verify by running the following comman

$ docker info | grep 'Security Options'

[root@ip-172-31-80-30 ec2-user]# more /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of three two values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are pro
tected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted

Refernece
https://www.cyberciti.biz/faq/what-is-selinux/
https://en.wikipedia.org/wiki/Security-Enhanced_Linux
http://jaormx.github.io/2018/selinux-and-docker-notes/

The post What is SELinux and how its SELinux used in Docker? appeared first on scmGalaxy.

Docker is one of the revolutions technologies which has created lots of buzz in the Software development practices. Docker has not only helped to setup Continuous Integration and Delivery but also manage and replicate test environments and deploy a large at scale in no time. Here are the following advantages which benefit to testing team using docker

• Docker will help setting up Continuous Integration and Delivery which will enable testing team to deploy and test application in very less time compare of using virtual machines.
• Efficient software teams push code to production multiple times a day. But this only works with good processes in place. Pull requests, code reviews, and good test coverage are essential for enabling a fast pace and high output of new code. Docker will help QA team to enable this in no time
• Docker Compose help to create a Application Stake for Developers and QA in very less time.
• Docker allows you to run your tests in containers as well as isolate your tests in development and deployment.
• Using Docker to manage and replicate test environments in no time.

But there is one limitation. The major problem of a Docker container for UI testing is that it does not have a screen output. There are in general two solutions:

1. Use a headless browser such as HTMLUnit that does not require a graphical user interface or
2. Simulate a screen output.

Recommended is second one because in this case you do not need to change my testing code to use a WebDriver for a headless browser. Moreover, headless browser may not have full functionalities of a real browser.  What I need is a display server called Xvfb or X virtual frame buffer. It performs all graphical operations in memory without showing any screen output.

You can find sample example in following urls.

https://medium.com/@yiquanzhou/run-selenium-ui-tests-in-docker-container-78be98e1b52d

http://testnblog.com/ui-automation-framework-on-docker/

The post How to run UI testing in Docker container using Selenium appeared first on scmGalaxy.

Issues – docker-compose prepends current directory name to named volumes

What actually happens is that the named volume gets prepended with (a simplified version of) the directory name from which the docker-compose command was run.

For instance, if I run from the “dcompos-programs” directory, and I name the volume “my_named_vol”, then I end up with a volume named “dcompos-programs_my_named_vol”.

docker-compose-named-volume.yml:

version: '3'
services:

solr:
 image: alpine:3.5
 container_name: foo
 volumes:
 - my_named_vol:/opt/foo
volumes:
 my_named_vol:

Result:

$ docker-compose -f docker-compose-named-volume.yml up -d && \
> echo "## named volume:" && \
> docker volume ls | grep my_named_vol && \
> echo "## stop" && \
> docker-compose -f docker-compose-named-volume.yml down && \
> echo "## rm volume" && \
> docker volume rm $(docker volume ls | grep my_named_vol | awk '{print $2}')
Creating network "deploymentroot_default" with the default driver
Creating volume "dcompos-programs_my_named_vol" with default driver
Creating foo

Answer
docker-compose uses a project name. By default it’s the directory name which prevents collisions with existing containers. But you can use -p to change the prefix name.

You can use the external volume setting to avoid the prefix.
https://docs.docker.com/compose/compose-file/#external

The post docker-compose prepends current directory name to named volumes appeared first on scmGalaxy.

Error 1 – Error starting host:  Error getting state for host: machine does not exist

<p style="font-weight: 400;">D:\kubernete>minikube-windows-amd64.exe start --kubernetes-version="v1.8.0" --vm</p>
<p style="font-weight: 400;">-driver="virtualbox" --alsologtostderr</p>
<p style="font-weight: 400;">W0110 <span data-term="goog_1571914274">12:16:04.517163</span>   10504 root.go:148] Error reading config file at C:\Users</p>
<p style="font-weight: 400;">\panan4\.minikube\config\config.json: open C:\Users\panan4\.minikube\config\conf</p>
<p style="font-weight: 400;">ig.json: The system cannot find the file specified.</p>
<p style="font-weight: 400;">I0110 <span data-term="goog_1571914275">12:16:04.528163</span>   10504 notify.go:109] Checking for updates...</p>
<p style="font-weight: 400;">I0110 <span data-term="goog_1571914276">12:16:05.901354</span>   10504 cache_images.go:290] Attempting to cache image: gc</p>
<p style="font-weight: 400;"><a href="http://r.io/k8s-minikube/storage-provisioner:v1.8.0" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://r.io/k8s-minikube/storage-provisioner:v1.8.0&source=gmail&ust=1515821717506000&usg=AFQjCNHilUJGRCqAxx0Naa3yTEDGQ9X2Dw">r.io/k8s-minikube/storage-provisioner:v1.8.0</a> at C:\Users\panan4\.minikube\cache\</p>
<p style="font-weight: 400;">images\<a href="http://gcr.io/" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://gcr.io&source=gmail&ust=1515821717506000&usg=AFQjCNHwyTmXfOb8jcAGQbTDyIr_DuEirg">gcr.io</a>\k8s-minikube\storage-provisioner_v1.8.0</p>
<p style="font-weight: 400;">I0110 <span data-term="goog_1571914277">12:16:05.901354</span>   10504 cache_images.go:290] Attempting to cache image: gc</p>
<p style="font-weight: 400;"><a href="http://r.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.5" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://r.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.5&source=gmail&ust=1515821717506000&usg=AFQjCNFAVT9yppX_1usJ2E0YbShOwXUE9A">r.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.5</a> at C:\Users\panan4\.mi</p>
<p style="font-weight: 400;">nikube\cache\images\<a href="http://gcr.io/" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://gcr.io&source=gmail&ust=1515821717507000&usg=AFQjCNF--H_EnOHq-1gORX9rvCyL0guvAA">gcr.io</a>\google_containers\k8s-dns-dnsmasq-nanny-amd64_1.14.5</p>
<p style="font-weight: 400;">Starting local Kubernetes v1.8.0 cluster...</p>
<p style="font-weight: 400;">Starting VM...</p>
<p style="font-weight: 400;">I0110 <span data-term="goog_1571914278">12:16:05.901354</span>   10504 cluster.go:74] Skipping create...Using existing ma</p>
<p style="font-weight: 400;">chine configuration</p>
<p style="font-weight: 400;">I0110 <span data-term="goog_1571914279">12:16:05.901354</span>   10504 cache_images.go:290] Attempting to cache image: gc</p>
<p style="font-weight: 400;"><a href="http://r.io/google_containers/kubernetes-dashboard-amd64:v1.6.3" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://r.io/google_containers/kubernetes-dashboard-amd64:v1.6.3&source=gmail&ust=1515821717507000&usg=AFQjCNERLC4qpuUBrUqm5OvSjac96pWNKw">r.io/google_containers/kubernetes-dashboard-amd64:v1.6.3</a> at C:\Users\panan4\.min</p>
<p style="font-weight: 400;">ikube\cache\images\<a href="http://gcr.io/" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://gcr.io&source=gmail&ust=1515821717507000&usg=AFQjCNF--H_EnOHq-1gORX9rvCyL0guvAA">gcr.io</a>\google_containers\kubernetes-dashboard-amd64_v1.6.3</p>
<p style="font-weight: 400;">I0110 <span data-term="goog_1571914280">12:16:05.901354</span>   10504 cache_images.go:290] Attempting to cache image: gc</p>
<p style="font-weight: 400;"><a href="http://r.io/google_containers/k8s-dns-kube-dns-amd64:1.14.5" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://r.io/google_containers/k8s-dns-kube-dns-amd64:1.14.5&source=gmail&ust=1515821717507000&usg=AFQjCNFhurp_V-c-NFhO73j_Zjakc4fptw">r.io/google_containers/k8s-dns-kube-dns-amd64:1.14.5</a> at C:\Users\panan4\.minikub</p>
<p style="font-weight: 400;">e\cache\images\<a href="http://gcr.io/" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://gcr.io&source=gmail&ust=1515821717507000&usg=AFQjCNF--H_EnOHq-1gORX9rvCyL0guvAA">gcr.io</a>\google_containers\k8s-dns-kube-dns-amd64_1.14.5</p>
<p style="font-weight: 400;">I0110 <span data-term="goog_1571914281">12:16:05.901354</span>   10504 cache_images.go:290] Attempting to cache image: gc</p>
<p style="font-weight: 400;"><a href="http://r.io/google-containers/kube-addon-manager:v6.4-beta.2" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://r.io/google-containers/kube-addon-manager:v6.4-beta.2&source=gmail&ust=1515821717507000&usg=AFQjCNEFsklfJPJCpLyEX7qsaLsvUDDRow">r.io/google-containers/kube-addon-manager:v6.4-beta.2</a> at C:\Users\panan4\.miniku</p>
<p style="font-weight: 400;">be\cache\images\<a href="http://gcr.io/" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://gcr.io&source=gmail&ust=1515821717507000&usg=AFQjCNF--H_EnOHq-1gORX9rvCyL0guvAA">gcr.io</a>\google-containers\kube-addon-manager_v6.4-beta.2</p>
<p style="font-weight: 400;">I0110 <span data-term="goog_1571914282">12:16:05.901354</span>   10504 cache_images.go:290] Attempting to cache image: gc</p>
<p style="font-weight: 400;"><a href="http://r.io/google_containers/k8s-dns-sidecar-amd64:1.14.5" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://r.io/google_containers/k8s-dns-sidecar-amd64:1.14.5&source=gmail&ust=1515821717507000&usg=AFQjCNEOfewUFCow70i9iSK2lBFDahW47A">r.io/google_containers/k8s-dns-sidecar-amd64:1.14.5</a> at C:\Users\panan4\.minikube</p>
<p style="font-weight: 400;">\cache\images\<a href="http://gcr.io/" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://gcr.io&source=gmail&ust=1515821717507000&usg=AFQjCNF--H_EnOHq-1gORX9rvCyL0guvAA">gcr.io</a>\google_containers\k8s-dns-sidecar-amd64_1.14.5</p>
<p style="font-weight: 400;">I0110 <span data-term="goog_1571914283">12:16:05.901354</span>   10504 cache_images.go:290] Attempting to cache image: gc</p>
<p style="font-weight: 400;"><a href="http://r.io/google_containers/pause-amd64:3.0" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://r.io/google_containers/pause-amd64:3.0&source=gmail&ust=1515821717507000&usg=AFQjCNF2E15ZIwSbjHDnD4zxOcapo39PIQ">r.io/google_containers/pause-amd64:3.0</a> at C:\Users\panan4\.minikube\cache\images</p>
<p style="font-weight: 400;">\<a href="http://gcr.io/" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://gcr.io&source=gmail&ust=1515821717507000&usg=AFQjCNF--H_EnOHq-1gORX9rvCyL0guvAA">gcr.io</a>\google_containers\pause-amd64_3.0</p>
<p style="font-weight: 400;">I0110 <span data-term="goog_1571914284">12:16:05.911354</span>   10504 cache_images.go:78] Successfully cached all images</p>
<p style="font-weight: 400;">.</p>
<p style="font-weight: 400;">I0110 <span data-term="goog_1571914285">12:16:06.292552</span>   10504 cluster.go:83] Machine state:  Error</p>
<p style="font-weight: 400;">E0110 <span data-term="goog_1571914286">12:16:06.292552</span>   10504 start.go:150] Error starting host: Error getting s</p>
<p style="font-weight: 400;">tate for host: machine does not exist.</p>
<p style="font-weight: 400;"></p>
<p style="font-weight: 400;">Retrying.</p>
<p style="font-weight: 400;">E0110 <span data-term="goog_1571914287">12:16:06.292552</span>   10504 start.go:156] Error starting host:  Error getting</p>
<p style="font-weight: 400;">state for host: machine does not exist</p>
<p style="font-weight: 400;">================================================================================</p>
<p style="font-weight: 400;"></p>
<p style="font-weight: 400;">An error has occurred. Would you like to opt in to sending anonymized crash</p>
<p style="font-weight: 400;">information to minikube to help prevent future errors?</p>
<p style="font-weight: 400;">To opt out of these messages, run the command:</p>
<p style="font-weight: 400;">        minikube config set WantReportErrorPrompt false</p>
<p style="font-weight: 400;">================================================================================</p>

Solutions

Please use/install minikube in the c drive.

The post Kubernetes minikube errors and Solutions appeared first on scmGalaxy.

Error

[root@localhost madhavi]# docker pull jenkins
Using default tag: latest
Warning: failed to get default registry endpoint from daemon (Cannot connect to the Docker daemon. Is the docker daemon running on this host?). Using system default: index.docker.io/v1/ 
Cannot connect to the Docker daemon. Is the docker daemon running on this host?
[root@localhost madhavi]# systemctl start docker
[root@localhost madhavi]# docker pull jenkins
Using default tag: latest
Pulling repository docker.io/library/jenkins
Error while pulling image: Get index.docker.io/v1/repositories/library/jenkins/images : malformed HTTP status code "online"
[root@localhost madhavi]#

Regards,
Rajesh Kumar
Twitt me @ twitter.com/RajeshKumarIn

The post Docker malformed HTTP status code “online” appeared first on scmGalaxy.

Error
error during connect: Get http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.26/info: open
//./pipe/docker_engine: The system cannot find the file specified. In the defau
lt daemon configuration on Windows, the docker client must be run elevated to co
nnect. This error may also indicate that the docker daemon is not running.

Solution
stackoverflow.com/questions/37527888/doc…nds-fails-in-windows

The following environment properties need to be set:
set DOCKER_CERT_PATH=%USERPROFILE%\.docker\machine\machines\default
set DOCKER_HOST=tcp://192.168.99.100:2376
set DOCKER_MACHINE_NAME=default
set DOCKER_TLS_VERIFY=1

$ docker-machine rm default
$ docker-machine create –driver virtualbox default

Regards,
Rajesh Kumar
Twitt me @ twitter.com/RajeshKumarIn

The post Docker Toolboox error in Windows appeared first on scmGalaxy.

1. Chef

• Manage nodes from a single server
• Cross-platform management for Linux, Windows, Mac OS, and more
• Integrates with major cloud providers
• Premium features available

• Permanent links
• RSS/email/IM integration
• After-the-fact tagging
• JUnit/TestNG test reporting
• Distributed builds

• Automatically enforce consistency of environments
• Works across physical and virtual machines
• A common tool-chain
• Support key DevOps best practices, including continuous delivery

• Supplies a number of built-in tasks for compiling, assembling, testing, and running Java applications
• Builds non-Java applications, such as C or C++ applications
• Pilot any type of process which can be described in terms of targets and tasks
• Extremely flexible and does not impose coding conventions or directory layouts to the Java projects which adopt it as a build tool

• Simple project setup follows best practices
• Easily work with multiple projects at one time
• Large repository of libraries and metadata that continue to grow
• Extensible, with the ability to write plugins in Java or scripting languages

• Collects, parses, and stores logs for later use
• Includes a web interface for searching and drilling into all of your logs
• Ship logs from any source, parse them, timestamp them correctly, index them, and search them

• Assemble multi-container apps and run on any infrastructure
• Compose an app using both proprietary containers and Docker Hub Official Repos
• Manage all containers of an app as a single group
• Cluster an app’s containers to optimize resources and provide high-availability

• Helps in the build, deployment, and maintenance of web software
• Application monitoring in one place
• Cross application and transaction tracing
• Database and availability and error monitoring

• Declarative builds and build-by-convention
• Language for dependency-based programming
• Structure your build
• Deep API
• Multi-project builds
• Ease of migration

• Working offline
• Fast to Work With
• Repositories Are Smaller
• Moving or Adding files
• Ignore Certain Files
• Branches
• Check the Status of Your Changes
• Stash Branches
• Cherry Pick Changes from Branches
• Find version that Introduced a bug using Binary Search

The post Top 10 DevOps Tools which is mostly used by DevOps Engineers | scmGalaxy appeared first on scmGalaxy.

The post Docker Command line Reference | Docker Tutorial | Docker Guide appeared first on scmGalaxy.

Need to learn Docker? This is the training for you! This training provides a soup-to-nuts learning experience for core Docker technologies, including the Docker Engine, Images, Containers, Registries, Networking, Storage, and more. All of the behind the scenes theory is explained, and all concepts are clearly demonstrated on the command line. No prior knowledge of Docker or Linux is required. Training Overview Training

Introduction

The post Docker Training | Docker Course | Agenda | scmGalaxy appeared first on scmGalaxy.

$ apt-get install docker (Ubuntu)
$ yum install docker  (RHEL/CENTOS)

$ docker pull jenkins 

$ docker run -d -p 8080:8080 -p 50000:50000 jenkins 

$ docker run -d -p 8080:8080 -p 50000:50000 -u root -v $PWD/jenkins:/var/jenkins_home jenkins 

docker run -d -p 49001:8080 -v $PWD/jenkins:/var/jenkins_home -t jenkins -u root 

$ mkdir jenkins
$ chown 1000 jenkins
$ docker run -d -p 49001:8080 -v $PWD/jenkins:/var/jenkins_home -t jenkins

$ docker exec name tail -f /var/log/jenkins/jenkins.log
Where name = --name 

The post How to Install Jenkins using Docker | Step by step guide | scmGalaxy appeared first on scmGalaxy.

The post Simple Docker workflow – Quick start | Docker Tutorial appeared first on scmGalaxy.

The post How to Install Docker in Linux? appeared first on scmGalaxy.

The post How to get bash or ssh into a running container in background mode? appeared first on scmGalaxy.