learning-docker/notes/4_under_the_hood.md

4. Under the Hood

Docker the program

What Kernels Do

• software core of computer
• Run directly on hardware, had many jobs
  • Respond to messages from the hardware
  • Start and schedule programs
  • Control and organize storage
  • Pass messages between programs
  • Allocate resources, memory, CPU, network, etc
  • Create containers by Docker configuring the kernel

What Docker Does

• Program written in Go
• Manages kernel features
  • Docker uses "cgroups" to contain processes, so each container (with its process) is isolated
  • Docker uses "namespaces" (feature of Linux Kernel) to contain networks
  • USes "copy-on-write" filesystems to build images
• Above features has been used by industry for years before Docker.

What Docker Really Does

• Makes scripting distributed systems "easy"

The Docker Control Socket

• Docker is two programs: a client & a server
  • They communicate via a socket
• The server receives commands over a socket (either over a network or through a "file")
  • When client & server are on same computer, a special "file" socket is created for communication
• The client can even run inside a docker container itself

location of docker socket file on linux: /var/run/docker.sock

We can control the docker server using docker client inside a container: docker run -it --rm -v /var/run/docker.sock:/var/run/docker.sock docker sh

Networking in Brief

TODO: Need further research this topic

• Ethernet layer: moves "frames" on a wire (or wireless)
• IP layer: moves packets on a local network
• Routing: forwards packets between networks
• Ports: address particular programs on a computer

Bridging

• Docker uses bridges to create virtual networks in computer
• They are like software network switches
• They control Ethernet layer
• You can turn off this protection with docker run --net=host options image-name command
  • --net=host gives container direct access to network
  • Useful for learning/debugging

Routing

• Creates "firewall" rules to move packets between networks
• NAT (Network Address Translation)
• Change the source address on the way out
• Change the destination address on the way back

sudo iptables -n -L -t nat

• -n for

--previlige=true will give docker all access

• Exposing a port = "port forwarding" in network layer

Namespaces

• Allow process to be attached to private network segments
• Private networks are bridged into a shared network with the rest of the containers
• Containers get their own copy of the networking stack

??? Need learn this section (Container Networking in linkedin) specifically

Processes and cgroups

Primer on Linux Processes

• Processes come from other processes (parent-child relationship)
• When a child process exits, it returns an exit code to its parent
• Process Zero (init) is the process that starts the rest
• In Docker, a container starts with an init process and vanishes when that process exit
  • By knowing the init process of the container, we can kill the container

docker inspect can be ...????

Resource Limiting

Set limit for

• Scheduling CPU time
• Memory allocation limits
• Inherited limitations and quotas (summed total cannot exceed the limit)