I have been spending a lot of my free time the last few months learning Kubernetes. Currently most implementations of Kubernetes use Docker as their container runtime. I wanted to share some of my knowledge gained as I learned. Since I claim to be a architecture I wanted to share the basic architecture of Docker.
What is a container?
It is a segmented process that contains only the required elements to complete it’s expected job. While a normal operating system has many libraries available to make it flexible container only has the required runtime and libraries to do it’s function. This reduced scope makes containers small and independent from operating systems. The segmentation is enforced by the container server. The container server runs as a process on another operating system.
Architecture of Docker
Docker is a server that runs a process called dockerd. This server provides a REST API for the creation, management and running of containers. For ease of management docker provides the docker command line interface to interact with the REST API. There is a company called Docker that provide a supported version of Docker called Docker Enterprise. Most people seem to use Docker community edition which is licensed under the Apache 2.0 license.
What is a registry?
Registry is a place to store container images. Docker maintains Docker Hub a huge public registry. Anyone can provide a image to Docker Hub allowing anyone else to consume it. Many companies choose to use a private registry to protect their company data and applications. Docker has two functions for registry a push and a pull:
- Push – sends a local image to the registry
- Pull – asks for the image to be stored locally
What is a docker image?
Docker images are built using layers and are read-only. Each layer in an image could be based upon a previous image or some unique customization. Images are compiled sets of instructions stored in a file called Dockerfile.
This Dockerfile defines a basic image that does nothing but ping google.com forever. When compiled this image has three layers:
Layer 1: FROM ubuntu:latest
- Use the ubuntu base operating system with the tag of latest
Layer 2: RUN apt-get update -q && apt-get install -qy iputils-ping
- Execute the command listed above that updates the operating system and installs iputils-ping
Layer 3: CMD [“ping”, “google.com”]
- Run the command ping google.com forever
Once compiled this new image can be uploaded to a repository as a new container.
What is a container?
It is a runable image. They can be stored locally or in a remote repository. Once you start running an image is becomes a unique container and writable. All changes are unique to that instance of the container and not changed on the image. You can spawn hundreds or thousands of containers from a single image.
What about isolation?
Isolation is critical otherwise the container is just a process on an operating system. This isolation in docker is provided by three things:
- namespaces – makes a container look and feel like a separate machine
- cgroups – A way to group processes together and apply resource limits
- capabilities – superuser privileges that can be enabled or disabled for a process
So cgroups are used to group together processes into namespaces. Namespaces creates isolated instances of different resources like network etc.. This provided the impression of being isolated.
What about networking?
For containers to talk to the outside world is critical networking is implemented along with the other seven namespaces as part of Docker. Initial docker networking was very limited. As an active open source project it continues to get better. I will skip the deep dive on Docker networking since it is mostly not part of Kubernetes.
Why do I care?
An honest question. Containers enable very rapid deployment of new code. They allow the implementation of micro-services which in turn should improve the rate of new features in code. So it’s really about speed. A simple comparison is the fact that I could setup this wordpress blog in 15 seconds with docker should help you understand the speed capabilities.