Skip to content

Commit 935e0ca

Browse files
Adez017Adez017
authored
Merge pull request #1334 from sachinggsingh/docs/docker-content
Docs/docker content
2 parents 01ac4b9 + a7f1fb2 commit 935e0ca

2 files changed

Lines changed: 191 additions & 28 deletions

File tree

‎docs/Docker/docker-commands.md‎

Lines changed: 147 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -398,6 +398,73 @@ docker-compose pull
398398

399399
---
400400

401+
## Docker Swarm Commands
402+
403+
Docker Swarm is Docker's native clustering and orchestration tool, allowing you to manage a group of Docker hosts as a single virtual system.
404+
405+
### Swarm Initialization & Node Management
406+
```bash
407+
# Initialize a swarm
408+
docker swarm init --advertise-addr <MANAGER-IP>
409+
410+
# Get the join token for workers
411+
docker swarm join-token worker
412+
413+
# Join a worker node to the swarm
414+
docker swarm join --token <TOKEN> <MANAGER-IP>:2377
415+
416+
# List nodes in the swarm
417+
docker node ls
418+
419+
# Promote a worker to manager
420+
docker node promote <NODE-ID>
421+
422+
# Demote a manager to worker
423+
docker node demote <NODE-ID>
424+
```
425+
426+
### Service Management
427+
```bash
428+
# Create a service
429+
docker service create --name my-service --replicas 3 -p 80:80 nginx
430+
431+
# List services
432+
docker service ls
433+
434+
# List tasks of a service
435+
docker service ps my-service
436+
437+
# Scale a service
438+
docker service scale my-service=5
439+
440+
# Update a service (e.g., image version)
441+
docker service update --image nginx:latest my-service
442+
443+
# Inspect a service
444+
docker service inspect my-service
445+
446+
# Remove a service
447+
docker service rm my-service
448+
```
449+
450+
### Stack Management
451+
Stacks are the swarm equivalent of Docker Compose, used to manage multi-service applications.
452+
```bash
453+
# Deploy a stack from a compose file
454+
docker stack deploy -c docker-compose.yml my-stack
455+
456+
# List stacks
457+
docker stack ls
458+
459+
# List services in a stack
460+
docker stack services my-stack
461+
462+
# Remove a stack
463+
docker stack rm my-stack
464+
```
465+
466+
---
467+
401468
## Advanced Commands
402469

403470
### Container Inspection
@@ -458,18 +525,25 @@ docker run --security-opt no-new-privileges nginx
458525

459526
| Command | Description |
460527
|---------|-------------|
461-
| `docker run` | Create and start container |
528+
| `docker run` | Create and start a container |
462529
| `docker ps` | List running containers |
463530
| `docker images` | List images |
464-
| `docker build` | Build image from Dockerfile |
465-
| `docker pull` | Download image |
466-
| `docker push` | Upload image |
467-
| `docker exec` | Execute command in container |
468-
| `docker logs` | View container logs |
469-
| `docker stop` | Stop container |
470-
| `docker rm` | Remove container |
471-
| `docker rmi` | Remove image |
472-
531+
| `docker build` | Build an image from a Dockerfile |
532+
| `docker pull` | Download an image from a registry |
533+
| `docker push` | Upload an image to a registry |
534+
| `docker exec` | Execute a command inside a running container |
535+
| `docker logs` | View a container's output logs |
536+
| `docker stop` | Stop a running container |
537+
| `docker restart` | Restart a container |
538+
| `docker rm` | Remove a container |
539+
| `docker rmi` | Remove an image |
540+
| `docker inspect` | Show detailed info on a Docker object |
541+
| `docker stats` | Show live resource usage statistics |
542+
| `docker-compose up` | Start a multi-container application |
543+
| `docker network ls` | List all Docker networks |
544+
| `docker volume ls` | List all Docker volumes |
545+
| `docker system prune` | Clean up unused images, containers, and networks |
546+
473547
### Quick Cleanup
474548

475549
```bash
@@ -491,6 +565,62 @@ docker volume prune
491565

492566
---
493567

568+
## Docker Security: Hardening Your Environment
569+
570+
Security is a critical aspect of containerization. Docker provides several built-in mechanisms to secure your applications and infrastructure.
571+
572+
### 1. Secrets Management
573+
Secrets allow you to store sensitive data (like passwords, API keys, or certificates) outside of your images or source code.
574+
```bash
575+
# Create a secret from a file
576+
docker secret create db_password ./password.txt
577+
578+
# List secrets
579+
docker secret ls
580+
581+
# Inspect a secret
582+
docker secret inspect db_password
583+
584+
# Use a secret in a service
585+
docker service create --name db --secret db_password mariadb
586+
```
587+
588+
### 2. Docker Content Trust (DCT)
589+
DCT allows you to use digital signatures for data sent to and received from remote Docker registries. These signatures allow client-side verification of the integrity and publisher of specific image tags.
590+
```bash
591+
# Enable Content Trust (shell session)
592+
export DOCKER_CONTENT_TRUST=1
593+
594+
# Pull only signed images
595+
docker pull nginx:latest
596+
```
597+
598+
### 3. Vulnerability Scanning
599+
Regularly scan your images for known vulnerabilities to ensure your software supply chain is secure.
600+
```bash
601+
# Scan an image for vulnerabilities
602+
docker scan my-image:latest
603+
```
604+
605+
### 4. User Namespaces & Rootless Docker
606+
Running Docker in "Rootless Mode" or using User Namespaces adds a layer of security by ensuring that even if a container is compromised, the attacker does not have root access to the host.
607+
```bash
608+
# Check if rootless mode is supported
609+
docker system info | grep "Rootless"
610+
611+
# Run a container with a specific user namespace
612+
docker run --userns-remap=default -it alpine sh
613+
```
614+
615+
### 5. Resource Isolation
616+
Prevent Denial of Service (DoS) attacks by strictly limiting the resources a container can consume.
617+
```bash
618+
# Limit memory, CPU, and pids (process limit)
619+
docker run -m 512m --cpus="0.5" --pids-limit 100 my-app
620+
```
621+
622+
---
623+
494624
## Best Practices
495625

496626
### Command Tips
@@ -502,21 +632,15 @@ docker volume prune
502632
5. **Use health checks** - Monitor container health
503633
6. **Clean up regularly** - Remove unused objects
504634

505-
### Security Tips
635+
### Security Best Practices
506636

507-
```bash
508-
# Don't run as root
509-
docker run -u 1000:1000 my-app
637+
1. **Don't run as root** - Use the `USER` instruction in Dockerfile or `-u` flag.
638+
2. **Use read-only filesystem** - Prevents attackers from writing to the container disk.
639+
3. **Scan images regularly** - Use `docker scan` to find vulnerabilities.
640+
4. **Use Secrets** - Never bake passwords or keys into your images.
641+
5. **Limit Resources** - Always set memory and CPU limits to prevent host exhaustion.
510642

511-
# Use read-only filesystem when possible
512-
docker run --read-only my-app
513-
514-
# Drop unnecessary capabilities
515-
docker run --cap-drop ALL --cap-add NET_BIND_SERVICE my-app
516-
517-
# Use security profiles
518-
docker run --security-opt apparmor:my-profile my-app
519-
```
643+
Refer to the **Docker Security** section above for more detailed commands and implementation details.
520644

521645
---
522646

‎docs/Docker/intro.md‎

Lines changed: 44 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -56,12 +56,51 @@ CMD ["node", "app.js"]
5656
### Registry
5757
A storage service for Docker images. **Docker Hub** is the most popular—like GitHub for Docker images.
5858

59-
### Volume
60-
Persistent storage that survives when containers are deleted. Use for databases, logs, and user files.
61-
62-
### Network
59+
### Volumes
60+
Persistent storage that survives when containers are deleted. Essential for databases, logs, and user-generated content.
61+
62+
#### Types of Volumes:
63+
1. **Named Volumes**: Managed by Docker. Best for persistent data like databases.
64+
```bash
65+
# Create a volume
66+
docker volume create pg_data
67+
# Run container with named volume
68+
docker run -d -v pg_data:/var/lib/postgresql/data postgres
69+
```
70+
2. **Bind Mounts**: Maps a host path to a container path. Best for development.
71+
```bash
72+
# Mount current directory to /app
73+
docker run -d -v $(pwd):/app node:18-alpine
74+
```
75+
3. **Tmpfs Mounts**: Stored in host memory (RAM). Best for sensitive or temporary data.
76+
```bash
77+
docker run -d --tmpfs /app/cache my-app
78+
```
79+
80+
### Networks
6381
Allows containers to communicate with each other securely.
6482

83+
#### Network Drivers & Use Cases:
84+
1. **Bridge (Default)**: Best for standalone containers that need to talk to each other on the same host.
85+
- **Use Case**: Connecting a frontend container to a backend container.
86+
```bash
87+
docker network create my-net
88+
docker run -d --net my-net --name db mysql
89+
docker run -d --net my-net --name app my-app
90+
```
91+
2. **Host**: Removes isolation between host and container (shares host IP).
92+
- **Use Case**: High-performance apps where network overhead must be minimal.
93+
```bash
94+
docker run -d --network host nginx
95+
```
96+
3. **Overlay**: Connects multiple Docker daemons together.
97+
- **Use Case**: Microservices spread across multiple physical servers (Docker Swarm).
98+
4. **None**: Disables all networking.
99+
- **Use Case**: Secure batch processing jobs with no external access needed.
100+
```bash
101+
docker run -d --network none alpine
102+
```
103+
65104
## Quick Start Workflow
66105

67106
**1. Create a Dockerfile**
@@ -159,4 +198,4 @@ Docker has revolutionized software development and deployment because:
159198
* **DevOps Integration**
160199
Perfect fit for CI/CD pipelines, enabling automated testing and deployment workflows.
161200

162-
Ready to dive deeper? Let's explore Docker installation and setup in the next section! 🚀
201+
Ready to dive deeper? Let's explore Docker installation and setup in the next section! 🚀

0 commit comments

Comments
 (0)