🚀 DevOps Docker Training Notes

📅 Day 1 — Traditional vs Containerized Deployment

🏗️ Traditional Deployment / Old Deployment

🖥️ Virtualized Deployment

❌ VM Disadvantages:

Each VM needs its own OS → high CPU, memory, and storage consumption.
Higher cost for enterprise OS editions.
Can deploy multiple applications in one VM, but no isolation.
Middleware conflicts — can't run multiple versions (e.g., Java 11 vs Java 17).
Environment inconsistencies (e.g., config files, env variables).
AMIs can help maintain consistency but still require full OS per VM.

🔴 Summary:

Each VM → full OS → high cost and compute usage.
Middleware/software compatibility issues.
No proper isolation for apps within same VM.

📦 Containerized Deployment

🧱 What is a Container?

Includes: App code + dependencies + config files + env variables.
Containers share the host OS (no separate OS required).
Each container has its own OS libraries → interacts with OS kernel.
Multiple containers can run on a single host OS.

🛠️ Use Cases:

Applications
Databases
Tools (e.g., Jenkins, Nexus)

🔐 Isolation:

Container runtime provides:
Separate process space
Network space
Storage space
Mount space
High CPU → container may hang.
Out of memory → container is killed by OS (via cgroups).

📅 Day 2 — Container Types and Tools

🧰 Container Use Cases:

🌐 Web Servers:

HTTPD, NGINX, HAProxy

💻 Application Servers:

Java, Python, Node.js, JBoss, Tomcat, Go

🗄️ Database Servers:

MySQL, Oracle, MongoDB, PostgreSQL, Couchbase, Cassandra

✉️ Messaging Servers:

Kafka, RabbitMQ

🛠️ Other Tools:

Jenkins, Nexus, SonarQube

🐳 Containerization Tools:

🔧 Runtime Tools:

Docker
Podman
containerd

📦 Orchestration Tools:

Docker Swarm
Kubernetes
OpenShift

🐳 Docker Editions:

Community Edition — Free
Enterprise Edition — Paid
DTR: Docker Trusted Registry
UCP: Universal Control Plane (GUI for managing containers)

Docker images built on any OS or flavor (RHEL, Ubuntu, etc.) can be stored in registries like Nexus/ECR and run on any platform.

📅 Day 3 — Docker Setup & Runtime

🚀 Container Limits

Number of containers depends on available CPU and RAM.

🧩 OS Compatibility:

Best OS for Docker: Ubuntu
Docker not compatible with RHEL in production (no support).

🔧 Docker Daemon

Background service managing:
Docker images
Containers
Networks
Volumes

🧰 Installing Docker on Ubuntu (AWS):

```bash sudo apt update -y sudo apt install docker.io -y sudo service docker start docker info Regular users will face permission issues.

✅ Add User to Docker Group: bash Copy code sudo usermod -aG docker $USER

OR

sudo usermod -aG docker ubuntu Logout and SSH again. Then run:

bash Copy code docker ps 📅 Class 4 — Docker Registries 🐋 Docker Image Storage 🔐 Secure Registries: Use HTTPS for registries like Nexus, ECR.

Docker Hub provides only one private repo → limited use in real-time.

📁 Docker Concepts Registry: Central image storage.

Repository: Collection of related images (usually different versions).

🔄 Image Pull Behavior: If registry not mentioned:

Docker checks local

Else pulls from Docker Hub

☁️ Create Repos in Nexus / ECR 🔹 ECR: Image format: registryURL/repository:tag

🔹 Nexus: Go to Settings → Repositories → Create Repository → Docker (hosted)

Use port 8083 for reverse proxy

⚠️ Insecure Registry Configuration: If using HTTP (insecure) registry:

Edit the daemon config:

bash Copy code sudo vi /etc/docker/daemon.json Add:

json Copy code { "insecure-registries": [":8083"] } 📝 If using for practice, and IP changes after restarting Nexus, you'll need to update the IP in daemon.json.

📅 Day 5 — Docker Image Build & Deployment ✅ Docker Advantages: Easy to share & deploy using Docker images

Lightweight — shares host OS, saves resources

Version management

Middleware compatibility solved

🛠️ Docker Build Server Setup: Install the following on Docker build server:

Docker

Git

Maven

Java

Don't write Dockerfiles directly on Docker server.

📁 Real-Time Workflow: Write Dockerfile in project repo.

Commit & push to GitHub.

Clone repo to Docker build server.

Build image and push to registry (ECR/Nexus).

Another deployment server pulls image and runs container.

🔗 Build and deploy happen on different servers.

🌐 Accessing the Application: Expose container ports to access apps via browser or API.

📅 Day 6 — Tagging & ECR Authentication 🏷️ Docker Image Tagging If image was created without proper name (e.g., missing registry/repo), use:

bash Copy code docker tag oldimagename:tag newregistry/repository:newtag You can see multiple names, but the Image ID remains the same.

🔐 Docker Login to ECR To authenticate with ECR registry:

Go to ECR repo

Click View Push Commands

Use the first command (requires AWS CLI):

bash Copy code aws ecr get-login-password --region | \ docker login --username AWS --password-stdin .dkr.ecr..amazonaws.com Must be executed on Docker build server.

🛡️ ECR Security Features: 🔐 Tag Immutability: Prevents overwriting existing image versions.

Enable this to ensure image stability.

Same concept applies to Nexus.

🔍 Scan on Push: Automatically checks for vulnerabilities when image is pushed.

🔐 KMS Encryption: Encrypt images stored in ECR using AWS KMS.

🛂 IAM Role & AWS CLI Access ✅ For Docker Build Server: Create and attach IAM policy with full ECR access.

Install AWS CLI.

Authenticate before push.

🔁 Note: Token is valid for 4 hours → must re-authenticate frequently.

✅ For Deployment Server: Install AWS CLI.

Attach read-only IAM policy.

Authenticate and pull images.

yaml