docker namespace

There are different types of namespaces and each one of them isolates applications from each other. They are created using the clone system call. One can also attach to existing namespaces.

  1. The pid namespace allows each container to have its own process

    1. Each pid forms its own process hierarchy. A parent
    2. can see the children namespaces and affect them, but a

    child can neither see the parent namespace nor affect it.

  2. The net namespace allows us to have different network interfaces on
    each container, like port. Each net namespace has its own routing
    table and firewall rules.
  3. ipc namespace sepratate IPC (Inter Process Communication) between
    different container's process;
  4. with mnt namespace, a container can have its own set of mounted
    filesystems and root directories, enhenance chroot.
  5. With uts namespace, we can have different hostnames for each
    container.
  6. With user namespace support, we can have users who have a nonzero ID
    on the host but can have a zero ID inside the container.

There are ways to share namespaces between the host and container and container and container.

摘自book: docker cookbook, 第一章 introduction and Installation, 第一节 Introduction

[using docker] 读书笔记 4

1) It’s important to set the USER statement in all your Dockerfiles (or change user within any ENTRYPOINT / CMD scripts). If you don’t do this, your processes will be running as root within the container. As UIDs are the same within a container and on the host, should an attacker manage to break the container, they will have root access to the host machine.

2) 查看container 的CPU, 内存, 网络使用情况
docker stats $(docker inspect -f {{.Name}} $(docker ps -q))

3) cAdvisor aggregates and processes various stats and also makes these available through a REST API, for further processing and storage.

[DevOps for Developers] 读书笔记1

dev & ops 分别对change的态度, 决定了...
devOps 是随着agile实践一步步发展而来, agile 先是在开发team, 后延续到ops team. 它强调的是合作, 沟通.

dev: change code, and want to delivery quickly to production;
ops: no change for production, keep it stable;

devops 概念的萌芽发展历程

  1. Patrick Debois coined the term DevOps in 2009 while organizing the
    DevOpsDays conference in Belgium.
  2. Patrick Debois ran a session called “Agile Operations and
    Infrastructure: How Infra-gile Are You?”4 at the Agile 2008
    conference in Toronto and published a paper with a similar name.
  3. Marcel Wegermann published a e-mail list called “Agile System
    Administration.”
  4. John Allspaw gave a presentation called “10+ Deploys per Day: Dev
    and Ops Cooperation”7 at the Velocity 2009 conference in San Jose.
  5. Steven Blank published a book called Four Steps to the Epiphany.
  6. Eric Ries published The Lean Startup9 and others have written on the
    “lean startup” scene.
  7. The 451 Group published the first analyst report on DevOps (titled
    “The Rise of DevOps”10) in September 2010.

DevOps can be examined from the following overlapping perspectives:

  1. Metrics and measurement view: This aspect addresses quality and
    testing and stresses shared incentives.
  2. Process view: This aspect covers congruence and flow to gain fast
    feedback and set up a holistic process.
  3. Technical view: This aspect discusses fast feedback through
    automation, particularly automatic releasing, specification by
    example, and infrastructure as code.

Docker Daemon 监听tcp端口, 远程API 调用

默认情况下, Docker Daemon 监听在本地的 unix:///var/run/docker.sock 上, 只允许本地 root 用户 docker client 连接. 如果要想远程连接, 必须监听 tcp 端口.

Docker Daemon 可以选择在启动的时候, 设置监听在 tcp 端口, IPC socket 监听, 或者2个都监听.

  • 首先看一下Docker Daemon 是不是在监听 (ps -aux | grep docker);
  • 如果已经起来了, 先shutdown (service docker stop);
  • 重新启动, 设置tcp 和 sock 同时监听 (sudo docker -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock -d &);
    官方关于设置Docker Daemon 的文档: http://docs.docker.com/articles/basics/

如下图:
Screen Shot 2015-07-12 at 12.12.17 PM.png

重新查看进程状态, 可以看到 Docker Deamon 已经起来了. 那么就可以远程http连接了
http://docker.tianxiaohui.com:2375/containers/json?all=1 (查看所有container)

使用 RESTful client, 启动一个container, 这里返回204, 代表没有任何错误
Screen Shot 2015-07-12 at 2.30.33 PM.png

官方关于docker remote API 的文档 http://docs.docker.com/reference/api/docker_remote_api/

Microservices architectures pros and cons 微服务架构的优缺点

这里全是引用或者从这篇文章引发的: Microservices - Not A Free Lunch!

pros:



    每个单独的服务都是以某个业务模块为中心, 不用关心其他服务, 开发简单;
    sale out, 伸缩性, HA
    rollback only involve single app
    每个服务都可以根据自己业务特性, 采用不同的内部架构, 工具, 开发语言;
    每个服务可以根据load 情况, 增加减少cluster内机器的数量;
    系统中的服务都是松耦合的, 便于开发, 维护;
    每个服务的开发团队都不至于太大, 团队之间相互独立;
    现在很多的开源的工具支持这种开发模式, 便于上手;

cons:



    原来你测试部署一个app就好了, 那么现在按照模块, 根据微服务架构拆分成了多个app, 相互提供服务, 那么你逻辑上就要有多个team, 多个app, 原来测试, 部署一个app就好了, 现在要部署测试多个app, 要有更多的开发, 测试, 生产环境;
    原来一个app 内部之间直接调用, 现在要通过网络, 要有服务注册, 发现机制; 网络之间的调用, 就有了failover;
    多个prodution cluster 在线上, 那么就需要等多的mnoitor, 报警机制, 以及分布式的log 机制;
    Substantial DevOps Skills Required
    定义接口, 单机应用的接口可以随时改变, 然后修改, 微服务的分布式架构就要求协调多个team, 按计划发布; 并且接口最好在一段时间内不要修改;
    Once we have distributed a system, we have to consider a whole host of concerns that we didn't before. Network latency, fault tolerance, message serialisation, unreliable networks, asynchronicity, versioning, varying loads within our application tiers etc.
    Asynchronicity Is Difficult!
    Testability Challenges