chapter five

5 Poking Docker

 

This chapter covers

  • What Docker is and where it came from
  • How Docker works under the hood
  • How to design chaos experiments for software running in Docker
  • How to do chaos experiments on Docker itself
  • Using tools like Pumba to easily implement chaos experiments in Docker

Oh Docker!. With its catchy name and the lovely whale logo, it has become the public face of Linux containers in just a few short years since the first release in 2013. I now routinely hear things like, “Have you dockerized it?” and, “Just build an image with that, I don’t want to install the dependencies.” And it’s for a good reason. Docker capitalized on existing technology in the Linux kernel to offer a convenient and easy-to-use tool, ready for everyone to adopt. It played an important role in taking container technology from the arcane to the mainstream.

In order to be an effective chaos engineer in the containerized world, we need to understand what containers are, how to peek under the hood, and what new challenges (and wins) they present to us. We will focus on Docker, as the most popular container technology.

DEFINITIONS

What’s exactly a container? We’ll define this term shortly, but for now just know it’s a construct designed to limit the resources a particular program running inside of a container can access.

5.1           My (dockerized) app is slow!

5.1.1   Architecture

5.2           The brief history of Docker

5.2.1   Emulation, simulation, and virtualization

5.2.2   Virtual machines and containers

5.2.3   Linux containers and Docker

5.3           Peeking under the Docker’s hood

5.3.1   Uprooting processes with chroot

5.3.2   Implementing a simple container(-ish) part 1 - using chroot

5.3.3   Experiment 1: can one container prevent another one from writing to disk?

5.3.4   Isolating processes with Linux namespaces

5.3.5   Docker and namespaces

5.3.6   Experiment 2: killing processes in a different pid namespace

5.3.7   Implementing a simple container(-ish) part 2 - namespaces

5.3.8   Limiting resource use of a process with cgroups

5.3.9   Experiment 3: Using all the CPU I can find!

5.3.10   Experiment 4: Using too much RAM

5.3.11   Implementing a simple container(-ish) part 3 - cgroups

5.3.12   Docker and networking

5.3.13   Capabilities and seccomp

5.3.14   Docker demystified

5.4           Fixing my (dockerized) app being slow

5.4.1   Booting up Meower

5.5.4   Security