The document discusses Docker containers and orchestration. It provides advice on using containers for development and production, the differences between containers and VMs, and how to configure and manage containers using Dockerfiles, orchestration tools like Kubernetes, and security best practices. Key concepts covered include pods, replication controllers, services, and replacing configuration management with orchestrators.

1. Dockerize it!
Alexnadalin-NAMSHI.com

4. WARNING

5. MINIMAL
DOCKER
AHEAD

6. playing with containers

7. figuring them out

8. never tried

9. DEMO

10. Container laws

11. Why containers?

12. remember
when...

13. require(‘http’).createServer(...)

14. <li ng-repeat=”item in items” … >

15. go func()

16. or when...

17. sudo service nginx restart

18. apt-get install curl

19. ulimit -n 1025

20. Systems are
boring.

21. Systems are
f*****g
boring.

22. Code is an F1 pilot

23. unique style

24. hard to replicate
hard to replicate
hard to replicatehard to replicate
hard to replicate

25. System is the F1 car

26. Robust

27. Reliable

28. Replicable

30. Systems aren’t
nice to build

31. They are nice
to orchestrate

33. VMs

34. How do they
differ from
containers?

35. “it’s just like a VM,
just much more lightweight”

36. “it’s just like a VM,
just much more lightweight”FLUFF

37. kernel

38. resources

39. isolation

40. security

41. “Containers have similar resource
isolation and allocation benefits as
virtual machines but a different
architectural approach allows them
to be much more portable and efficient”
https://www.docker.com/what-docker

42. Law #1
Even though they might try to
solve similar problems,
containers and VMs are
fundamentally different

43. 1996

48. https://github.com/docker/libcontainer/blob/master/PRINCIPLES.md

49. runC

50. Law #2
Docker is not here to stay
(at least in the way we
think of it nowadays)

51. Think that
Docker is simple

53. Think that
Docker is simple

54. # docker-compose.yml
services:
web:
build: .
ports:
- "8080:8080"
volumes:
- .:/src
$ docker-compose up

55. expand the horizon

58. We have Docker in our
system

59. We’re developing
a nodejs app

60. without nodejs

61. we’re exposing it from
our container to our host
(-p 8080:8080)

62. then we’re running ngrok
to expose our host
to the internet

63. without ngrok

65. Law #3
Containers aren’t suitable for dev
or production, containers are
suitable for use-cases

76. docker pull graylog2/allinone

77. Law #4
Dockerfiles are the simplest form
of configuration management

78. Orchestrating
containers isn’t
simple.

79. But it’s the
fun part :-)

81. apiVersion: v1
kind: ReplicationController
metadata:
name: app
labels:
name: app
spec:
replicas: 1
selector:
name: app
template:
metadata:
labels:
name: app
spec:
containers:
- name: master
image: my-nodejs-app
ports:
- containerPort: 1234

82. apiVersion: v1
kind: ReplicationController
metadata:
name: app
labels:
name: app
spec:
replicas: 1
selector:
name: app
template:
metadata:
labels:
name: app
spec:
containers:
- name: master
image: my-nodejs-app
ports:
- containerPort: 1234

83. kubectl create -f
/path/to/definition.yml

84. PODs
REPLICATION CONTROLLERS
SERVICES

85. PODs
REPLICATION CONTROLLERS
SERVICES

86. A set of logically linked containers

88. PODs
REPLICATION
CONTROLLERS
SERVICES

89. The guy who makes sure
PODs are up & running

91. apiVersion: v1
kind: ReplicationController
metadata:
name: app
labels:
name: app
spec:
replicas: 1
selector:
name: app
template:
metadata:
labels:
name: app
spec:
containers:
- name: master
image: my-nodejs-app
ports:
- containerPort: 1234

92. kubectl scale
--replicas=2 rc app

94. PODs
REPLICATION CONTROLLERS
SERVICES

101. The DataCenter of the
future is taking shape

102. Law #5
Configuration management is
(almost) dead
Long live orchestrators

104. Law #6
Talk services, not machines

105. NERDADVICE
Containers aren’t
better than VMs,
it really just
depends on what
you need to do
https://goo.gl/DGQKDA

106. NERDADVICE
Forget about the
hosts, go GCE if
you can
https://goo.gl/haanq4

107. NERDADVICE
Else, use a mature
orchestration
platform
http://kubernetes.io/
https://goo.gl/sbk3Hk (swarm)
http://mesos.apache.org/

108. NERDADVICE
Run your hosts
on safe, light OS
like CoreOS
https://coreos.com/

109. NERDADVICE
Use Alpine for
your containers,
it’s a minimal
security-oriented
Linux distro
http://goo.gl/MF4nKp

110. NERDADVICE
Avoid running
containers as
root
http://goo.gl/MF4nKp

111. NERDADVICE
Regularly scan
your clusters to
see if there’s any
security gotcha
https://goo.gl/l8tO31

112. NERDADVICE
Isolate
“colanders” like
jenkins in
containers
https://goo.gl/1HuQjV

113. NERDADVICE
Stop manually
installing
software on your
own machine
https://goo.gl/9fHWHU

114. NERDADVICE
Live like it’s 2016
https://goo.gl/2FNwGq
https://github.com/coreos/rkt
https://runc.io/

115. Alessandro Nadalin

116. Alessandro Nadalin
@_odino_

117. Alessandro Nadalin
@_odino_
Namshi

118. Alessandro Nadalin
@_odino_
Namshi
VP Technology

119. Alessandro Nadalin
@_odino_
Namshi
VP Technology
odino.org

120. Thanks!
Alessandro Nadalin
@_odino_
Namshi
VP Technology
odino.org

121. we are hiring!
tech.namshi.com/join-us
github.com/namshi
twitter.com/TechNamshi
tech.namshi.com