Docker on Thorsten Hans

WebAssembly and Containers with Docker Desktop - Hello World & Beyond

Wed, 28 Feb 2024 15:27:55 +0100

On top of being the runtime for containers, Docker Desktop is also able to run WebAssembly (Wasm) workloads. In this article, we’ll explore how one can run both containers and Wasm workloads together to build distributed architectures using the best of both worlds.

Beta Feature: Wasm workloads in Docker Desktop is currently marked as a beta feature.

What we are going to build

Discovering new topics, or learning emerging technologies often goes best when looking at a practical example. For the sake of this article, we’ll start with a simple Hello, World. From there, we’ll move on and orchestrate a simple three-tier application consisting of two containers (frontend and postgres) and a Wasm module (api).

How to build multi-arch Docker Images with ease

Mon, 03 Oct 2022 13:25:44 +0200

With the rise of ARM-based cloud computing resources and Apple’s switch from Intel-based CPUs to Apple Silicon, building Docker Images for multiple architectures has become increasingly important. We, as developers, must ensure that our applications can be executed on every potential architecture. We can easily achieve that by using Docker CLI and the buildx plugin. This article will look at building Docker Images for multiple architectures by containerizing a simple Go application. Before we dive into building the multi-arch Docker Images, let’s quickly revisit what buildx is.

Docker SBOM - or how to dive into shift-left security

Tue, 03 May 2022 08:02:03 +0200

Recently, Docker added a new command to Docker CLI. docker sbom. We can use this command to create a Software Bill of Materials (SBOM) for any container image. Another great capability when it comes to shift-left security. This post explains why you should want to have SBOMs for all the container images of your application. How to get them and which actions you can take based on SBOMs to improve the overall security of your containerized workloads.

How to lint Docker images with Dockle

Thu, 28 Apr 2022 19:26:56 +0200

We’ve been building container images for quite some time (read almost decades) now. Although tooling, editor, and IDE support have matured, we should not forget about hardening container images in the inner loop. This post demonstrates how to use Dockle to lint your container images according to security best practices.

Why should we lint container images

We’ve to talk about the „why". Why should we lint container images? We should lint container images to

Check if your application is running in a Docker container

Thu, 21 Apr 2022 17:22:42 +0000

Especially when building cloud-native applications, we tend to develop applications that run in any environment. We design components, so we can run them with or without container technologies to ensure we can host the application on different application platforms. However, sometimes we may have to determine if our applications are running inside a Docker container or not. This allows us to take particular actions at runtime without adding additional environment variables or configuration values (state). Every container has a .dockerenv file in the file system’s root. That said, we can quickly check for the existence of that file to determine reliably if our application runs inside a container or not. For demonstration purposes, this post shows how to determine if the application is executed in a container using Go and Rust.

Read-only filesystems in Docker and Kubernetes

Tue, 19 Oct 2021 13:31:43 +0000

You should harden your containerized workloads to minimize the attack surface of your overall application. Paying close attention while building your container images and applying proven patterns will reduce the risk of an attack while running your application in production. One of the simple practices to apply is setting the filesystem of your containers to read-only, and that’s exactly what we will cover in this article.

Read-only filesystems in Docker

Docker and compliant CLIs offer the read-only flag, which we can use when mounting the container’s filesystem as read-only. Let’s try it! Let’s start a new container from the official ubuntu image with an interactive TTY, to verify that the filesystem is read-only. The following docker run command uses -it (creates an interactive pseudo TTY and ensures STDIN is kept open) and --rm (removes the container automatically once exited):

Send a Microsoft Teams message when new OCI artifacts appear in Azure Container Registry

Fri, 27 Aug 2021 10:16:31 +0000

Getting instant feedback when a new artifact is published in a container registry such as Azure Container Registry (ACR) is important. Everyone has to stay in the loop, especially when working in a large team and managing many containerized applications. By leveraging ACR webhooks and the Microsoft Teams Inbound Webhook connector, you can easily send custom messages to a team for different activities happening in your container registry.

This article guides you through connecting ACR with Microsoft Teams to send messages automatically to a specific team when a new version of an image or an OCI compliant artifact is pushed to ACR.

Determine the size of Docker image layers

Tue, 15 Dec 2020 00:00:00 +0000

Let’s quickly recap what Docker layers are before we look at how to query their size. No worries, we look at the tip of the iceberg.

What are Docker layers

Every Docker image consists of layers. A single layer is the result of a particular instruction someone wrote down in a Dockerfile. Docker ads a new layer to the stack for each instruction of the Dockerfile. All layers together build the final Docker image.

How to build smaller and secure Docker Images for .NET

Mon, 07 Dec 2020 00:00:00 +0000

TL;DR

This post explains how to optimize a .NET 5 Docker image and address two main concerns. Image size and security vulnerabilities. The article shows how to reduce the size from ~210 to ~58 MB. Additionally, it shows how to remove all 59 vulnerabilities.

What we get from Microsoft

Visual Studio (also Visual Studio for Mac) creates a relatively simple Dockerfile for .NET projects. It is a good starting point for users new to Docker. However, users should apply several optimizations before using the Dockerfile to create Docker images for production environments.

Run containers in Azure Container Instances straight from Docker CLI

Thu, 03 Dec 2020 00:00:00 +0000

A couple of months ago, both Microsoft and Docker announced the seamless integration of Azure Container Instances (ACI) and Docker CLI. As a container enthusiast, I had to look into this integration. I tested it in different scenarios to see how it could support me and increase my productivity.

tl;dr: The integration of ACI and Docker CLI is excellent. Once configured, I found myself spinning up numerous containers :). It provisions even multi-container applications based on Docker Compose. There is a downside. Pulling images from registries was slower compared to my local machine. Overall, I like the experience and share everything you need to know about it in this article.

Scan Docker images for vulnerabilities with Docker CLI and Snyk

Thu, 03 Dec 2020 00:00:00 +0000

Vulnerabilities are everywhere. Application developers use frameworks and libraries to solve business requirements. An operating system executes applications and their dependencies, and vulnerabilities could exist in each of those layers.

Obviously, as application developers, we fix potential vulnerabilities in our code-bases. However, fixing critical vulnerabilities in the Linux distribution our applications rely on, is probably not what we are responsible for. Often, it is more important to know which vulnerabilities exist and how we can fix them.

Container Metrics With CTOP

Fri, 22 May 2020 00:00:00 +0000

A while ago, I stumbled upon ctop; a small, yet handy command-line tool to interact with Docker containers and gather essential metrics. You know docker stats? ctop is docker stats on steroids. The open-source tool is available for free and can be installed directly on Linux and macOS.

ctop - Essential metrics for Docker containers

With ctop, you get more than just fundamental metrics. Overall, ctop combines the following features in one single tool:

Docker Container CPU Limits Explained

Mon, 18 May 2020 08:30:00 +0000

If we think about Docker containers, we tend to associate words like efficient and small to them. Although this may be the case for the vast of situations, there are exceptions. There are containers that - perhaps unintentionally - have a very high CPU utilization. This post explains how you can limit CPU utilization for specific Docker containers to have better control of the overall hardware utilization.

On top of providing CPU limits for Docker containers, you should also limit the memory consumption. Consider reading my article, Limit Memory For Docker Containers , and learn how to prevent memory-intensive Docker containers from draining your overall system performance.

Docker Container Memory Limits Explained

Fri, 15 May 2020 08:30:00 +0000

When running Docker Images locally, you may want to control how many memory a particular container can consume. Otherwise, it may end up consuming too much memory, and your overall system performance may suffer. By default, Docker does not apply memory limitations to individual containers. Containers can consume all available memory of the host.

No need to panic (for most of the users)! If you are using Docker Desktop , the host is actually a virtualized host. On macOS, the host is a virtualized system leveraging Apple’s Hypervisor framework (which has been released with macOS 10.10 Yosemite). We use the Docker Desktop app, to specify an overall limit for containerized workloads.

How To Run Commands In Stopped Docker Containers

Thu, 14 May 2020 00:00:00 +0000

You may already know the exec command, which allows you to execute a command inside of a running Docker container. This works excellent and will enable us to dive into a running container to inspect certain things like files in the file system, running processes, and other stuff. However, exec does not work when the Docker container stopped already. The following lines will explain and demonstrate how to run commands in stopped Docker containers.

ACR Unleashed – Use ACR As Registry For Helm Charts

Wed, 29 Apr 2020 00:00:00 +0000

The seventh and last part of Azure Container Registry Unleashed is about housing Helm charts in ACR. This post explains how to use ACR as a protected Registry for Helm charts. We walk through the process of creating, publishing, and consuming a sample chart from ACR. However, if you have not used or seen Helm 3 before, consider reading my “Getting started with Helm 3 ” article first.

What Is OCI And What Are OCI artifacts

On top of Docker Registry 2.0, Azure Container Registry supports OCI artifacts. The OCI specification defines a general format for interchanging various artifacts like Docker Images or application bundles such as Helm charts. The official definition of OCI’s responsibility is

ACR Unleashed – Image Scanning With Azure Security Center

Mon, 20 Apr 2020 00:00:00 +0000

The sixth part of Azure Container Registry Unleashed is about scannig Docker Images in ACR using Azure Security Center . This post explains, what you get from Azure Security Center in the context of ACR and how to configure the integration of both Azure services. Before we dive into the article, I want to reach out and say thank you to my fellow MVP and well-known Azure security expert Tom Janetscheck for contributing to this article.

ACR Unleashed – Tasks

Wed, 05 Feb 2020 00:00:00 +0000

The fifth part of Azure Container Registry Unleashed is all about automating things in the context of Docker Images and ACR. Starting from scratch with simple, yet useful ACR Quick Tasks, over regular ACR Tasks to full-fledged ACR Multi-Step Tasks, this article covers everything you need to know about Tasks in ACR.

What Are ARC Tasks

With Azure Container Registry (ACR), customers can use so-called tasks to offload several workloads from local machines, and services such as GitHub or Azure DevOps to Azure Container Registry. With ACR Tasks, customers can build, push, and run Docker Images for different platforms, including Linux, Windows, and ARM. As of today, there are three different types of Tasks available in ACR:

ACR Unleashed – Webhooks

Wed, 04 Dec 2019 00:00:00 +0000

In the fourth part of Azure Container Registry Unleashed, we will dive into webhooks offered by ACR and learn how to use them to build simple, yet powerful automations based on ACR interactions such as pushing new tags of an image.

What Is A Webhook

Before we dive into ACR webhooks, let us do a quick refresher on webhooks. However, if you are familiar with webhooks, skip this paragraph and move on to (ACR webhooks).

Docker on Windows - Fix Time Synchronization Issue

Wed, 27 Nov 2019 00:00:00 +0000

During validation of Windows as main operating system (which is still ongoing), I experienced strange issues when trying to build my blog using the jekyll/jekyll Docker Image running on Windows 10.

At some point, jekyll build printed strange warnings that my shiny new article wont be compiled because it has a date in future.

I checked the filename and frontmatter metadata of the post. However both looked good. So I dived a bit deeper and recognized that the date within the container was set to 25th of November whereas my host system was displaying the 27th of November.

ACR Unleashed – Integrate ACR And Azure Monitor

Tue, 26 Nov 2019 00:00:00 +0000

The third part of Azure Container Registry Unleashed will guide you through the process of integrating ACR and Azure Monitor to collect essential information and metrics about your ACR instances at runtime. The integration of ACR and Azure Monitor is currently in public preview. However, retrieving insights about your ACR instance is mission-critical, so we will dive into this topic now.

What Is Azure Monitor

Azure Monitor is a centralized hub for aggregating, analyzing, visualizing and working with data. It consumes data from different sources and collects that data in data stores. All data collected by Azure Monitor fits into on of two categories, logs and metrics.

ACR Unleashed – Authentication, Identity Access Management And Content-Trust

Thu, 21 Nov 2019 00:00:00 +0000

This is the second part of Azure Container Registry Unleashed. Today, we will go one step further and talk about Authentication (AuthN), Identity Access Management (IAM) and Content-Trust in the scope of ACR. To be a bit more precisely, this post contains the following sections:

ACR Authentication

As mentioned in the first post of the series, Azure Container Registry integrates seamlessly with Azure Active Directory (AAD) and offers several ways to authenticate. Basically, you should differentiate between user-involved authentication and headless authentication, which is typically issued by a service in service-to-service scenarios. Having all authentication calls separated into those two categories, finding the correct authentication-pattern becomes easier.

ACR Unleashed – ACR Up And Running with Geo Replication

Tue, 19 Nov 2019 00:00:00 +0000

Azure Container Registry – or short ACR - is a managed service offered by Microsoft Azure. It is a private Docker Registry based on Docker Registry 2.0 and acts as central service in many containerized application architectures. Compared to other private Docker registries, ACR offers several advantages like ease of administration due to powerful Azure CLI commands, seamless integration with other Azure Services such as Azure Kubernetes Service and frictionless authentication using Azure Active Directory (AAD).

Integrating Azure Key Vault with Azure Container Services

Fri, 11 May 2018 00:00:00 +0000

With Azure Key Vault, Microsoft is offering a dedicated and secure service to manage and maintain sensitive data like Connection-Strings, Certificates, or key-value pairs.

We’re hoping to see a native Azure Key Vault integration for Azure Container Services (ACS) in the near future. At least the official FAQ mentions the feature on the product’s roadmap. Until this features will be shipped and if you’re using another Kubernetes environment - such as GCP or AWS offerings -, you’ve to integrate Azure Key Vault manually into your application building blocks to get rid of storing most sensitive data in plain old Kubernetes Secrets.

Deploy Azure Functions to Kubernetes and scale them automatically

Fri, 26 Jan 2018 00:00:00 +0000

Azure Functions has become my standard framework to build serverless backends for Single Page Applications (SPAs). It’s easy to get started with Azure Functions, although the platform itself is really powerful and highly configurable. I really love the cloud hosting capabilities for Azure Functions, but from time to time, it’s not allowed to use the public cloud as the deployment target.

Azure Functions can easily be hosted in different environments. You can download the entire runtime and execute it on-premises (if you have to) or you can use the existing Docker image and deploy your serverless backend to Kubernetes. And that’s exactly what this post will describe, you’ll create a sample Azure Functions project including a docker container, deploy it to a Kubernetes cluster and let it automatically scale based on CPU utilization.

Using Azure Files in Kubernetes Deployments with ASP.NET Core

Mon, 21 Aug 2017 00:00:00 +0000

Azure Container Services (ACS) makes it incredibly easy to spin up and manage Kubernetes clusters in the cloud. There are plenty of other Azure resources which you can use to build daily scenarios on a native cloud stack. Common scenarios are serving files from and writing important information to persisted locations. Azure offers many different storage capabilities. In this post, I’ll explain how to use an Azure File Share to serve content by using a .NET Core Web API.

How to use a private Azure Container Registry with Kubernetes

Fri, 18 Aug 2017 00:00:00 +0000

Besides using the goodness of Azure Container Services (ACS). Different Azure services like Azure Container Registry (ACR) and Azure Container Instances (ACI) can be used and connected from independent container orchestrators like kubernetes (k8s). This post will explain how to set up a custom ACR and connect it to an existing k8s cluster to ensure images will be pulled from the private container registry instead of the public docker hub.