1. Using Volumes to Develop Applications in Containers

Question 1

What can be said about the mutability of container images?

Answer 1

They are immutable — they don’t change.

Question 2

How are container images defined?

Answer 2

They are defined declaratively using a text file called Dockerfile.

Question 3

What does a Dockerfile contain?

Answer 3

A sequence of special instructions that inform Docker on how to create the container image.

Question 4

What kind of details do Dockerfile instructions define?

Answer 4

1. Which base image to use
2. Which source files need to be copied from the host into the image
3. The command that our container derived from the image will run
4. And so on…

Question 5

What process do we need to get an image built with an application inside it in Docker?

Answer 5

Docker’s image build process.

Question 6

What happens when an image build is invoked using Docker’s CLI?

Answer 6

Docker reads and acts on the instructions in the Dockerfile, and makes use of any build artefacts such as compiled binaries to assemble the image that embodies the software application or service we want the container to run.

Question 7

What is a Docker image?

Answer 7

It’s a template for the container.

Question 8

Where does Docker’s image build process fit into the software development cycle?

Answer 8

Just before we get to the point where we need to run the application, and after we compile it.

Question 9

What is the drawback of complex image definitions and how can this be alleviated?

Answer 9

Complex image definitions can take a significant amount of time to build and this can severely impact the productivity of a software developer. Our best bet for alleviating this is to develop inside the container where our code is destined to run.

Question 10

What are the three implications of developing apps inside a container?

Answer 10

1. Source code is part of the container’s filesystem
2. Can run application and tests using the CLI
3. Changes don’t persist on container deletion (ephemeral by nature)

Question 11

What does Docker use to get around the ephemeral nature of data that’s located within a container’s file system?

Answer 11

Volumes.

Question 12

What are Docker volumes?

Answer 12

A Docker volume is an area of persistent storage that is located outside of the container.

Question 13

Where are Docker volumes located?

Answer 13

On the host that’s running Docker, on the network, or even cloud storage.

Question 14

How does Docker use to work with volumes?

Answer 14

Volume plug-ins — a plug-in system for implementing storage solutions.

Question 15

How does Docker provide access to data stored outside of the container?

Answer 15

It mounts the storage area into the container during the life of the container and unmounts the storage when it gets removed.

Question 16

What are the three types of Docker volumes?

Answer 16

1. Tmpfs Mount
2. Named or Anonymous Volume
3. Bind Mount

Question 17

What are Tmpfs mounts?

Answer 17

Temporary areas of storage that mounts a storage location in the memory onto a destination in the container’s file system.

Question 18

What is the primary use case of Tmpfs mounts?

Answer 18

Writing sensitive data to the container’s file system during its execution without ever touching a disk and becoming open to compromise.

Question 19

What are named or anonymous volumes?

Answer 19

A designated area of storage that resides within a protected area under Docker’s control.

Question 20

How can named or anonymous volumes be manipulated?

Answer 20

Using Docker CLI.

Question 21

What do bind mounts allow us to do?

Answer 21

Mount an arbitrary directory on the host onto an arbitrary target location inside a container.

Question 22

What can be said about the changes made inside a bind mount in terms of reflection?

Answer 22

Changes made in the bind mound from the container are reflected on the host and vice versa.

Question 23

What is the explicit approach of creating a Docker volume?

Answer 23

Running the volume subcomand in the Docker CLI along with the verb create and specifying a name for the volume.

docker volume create code-volume

Question 24

What is the explicit approach of creating a Docker volume?

Answer 24

Running the volume subcomand in the Docker CLI along with the verb create and specifying a name for the volume.

docker volume create code-volume

Question 25

What is the explicit approach of creating a Docker volume?

Answer 25

Running `the` volume subcomand in the Docker CLI along with the verb `create` and specifying a name for the volume. `docker volume create code-volume`

Question 26

What is the implicit approach of creating a Docker volume?

Answer 26

Providing a `--volume` option as part of the `docker run` command. The argument specifies the volume name and the mount to use inside the container. `docker run --volume code-volume:/app`

Question 27

What happens when using the implicit approach to create a Docker volume if the volume already exists and what happens if it doesn't?

Answer 27

It gets mounted if it exists and it gets created and mounted if it doesn't.

Question 28

What is the implicit approach of creating a Docker volume?

Answer 28

Providing a `--volume` option as part of the `docker run` command. The argument specifies the volume name and the mount to use inside the container. `docker run --volume code-volume:/app`

Question 29

What happens when using the implicit approach to create a Docker volume if the volume already exists and what happens if it doesn't?

Answer 29

It gets mounted if it exists and it gets created and mounted if it doesn't.

Question 30

What Docker CLI sub-command can be used to list, inspect, and remove volumes? Why can this be done?

Answer 30

The sub-command `volume`. This is because volumes are first-class citizens of Docker. `docker volume [ls/inspect/rm]`

Question 31

What are the advantages of using named volumes?

Answer 31

1. They are Docker API objects, which means we can manage them easily 2. They are a part of Docker's internal data store, which means they are isolated from nefarious or accidental exposure or removal. 3. We know where they reside, so they're easy to identify and backup. 4. Better performance when using Docker Desktop.

Question 32

What are the disadvantages of using named volumes

Answer 32

1. They are owned by the root user, which means you must run your container as the root user in order to write to the volume. (Bad for security, avoid.)

Question 33

What can be said about running a container as the root user?

Answer 33

It is generally considered a bad practice for security reasons and should be avoided if at all possible.

Question 34

What is a bind mount?

Answer 34

A location on the host mounted into a container.

Question 35

How do you issue a bind mount when running a container?

Answer 35

By using the `--volume` option to specify the *absolute path* to the file or directory on the host and also the *absolute path* in the container where the directory is to be mounted separated by a column. ``` docker run --volume /path/on/host:/path/in/container ... ```

Question 36

What can be said about bind mounts in comparison to named volumes?

Answer 36

While named volumes impose a big restriction on us, bind mounts give us greater flexibility for data persistence.

Question 37

What is the build context?

Answer 37

A location on the host that contains the application source and any other items that need to be embodied in the image, as well as a Dockerfile.

Question 38

How do you specify what image to use in the Dockerfile?

Answer 38

By using the `FROM` instruction. ``` FROM node:14 ```

Question 39

How do you specify the working directory in the Dockerfile?

Answer 39

By using the `WORKDIR` instruction. ``` WORKDIR /app ```

Question 40

How do you instruct the contents of the Dockerfile's current directory to be copied across to the working directory inside the container?

Answer 40

By using the `COPY` instruction and passing it two dots separated by spaces. The first one indicates the Dockerfile's current directory and the second one specifies the working directory inside the container. ``` COPY . . ```

Question 41

How do you instruct commands to be run once the app source is copied across to the working directory inside a container in the Dockerfile?

Answer 41

By using the `RUN` instruction and giving it the commands to run, separated by `&&`. ``` RUN npm install && npm install -g nodemon ```

Question 42

How do you specify a port on which the containerised application listens for requests in the Dockerfile?

Answer 42

By using the `EXPOSE` instruction and passing it the port number. ``` EXPOSE 3000 ```

Question 43

How do you specify the container's default command (what gets executed) in the Dockerfile?

Answer 43

By using the `CMD` instruction and and passing it each word of the full command as an array. ``` CMD [ "node", "src/index.js" ] ```

Question 44

How do you build a Docker image?

Answer 44

By using the `build` subcommand and passing it the name of the app using the `-t` option as well as the path to the build context. ``` docker build -t myapp:1.0 . ``` ps. The dot (.) at the end specifies the current working directory.)

Question 45

What happens when we invoke an image build?

Answer 45

Docker steps through each Dockerfile instruction until it gets to the end of the sequence, and we have a new image built for the application.

Question 46

What are the two key concepts of handling dynamic changes in Docker?

Answer 46

1. Watch for changes — edits to source code are automatically detected inside running container. 2. Perform hot reload — process monitor performs a hot reload by restarting the application in the container.

Question 47

What are the three key outcomes of mounting our source conte into the working directory using bind mount?

Answer 47

1. Changes made to the source located on the host are reflected in the container via the bind mount volume. 2. The hot reload utility automatically detects any changes to the source files and restarts the server. 3. The changes can be tested to check they have implemented desired behaviour.

Question 48

What is the issue with the file/folder permissions that needs handling when working with bind mounts?

Answer 48

The default user in the container is the root user, whose user ID and group ID don't match the user developing the app. This mismatch can cause some unexpected behaviour. eg. If you create a file on the Docker host by using the touch command, you will se that the owner of this file is the local user. However, when we run a container that uses a bind mount and use the touch command inside the container, the owner of the created file will be the container's root user, which means that it's owned by the root user on host. If you try to write to this file, you can't. You don't have the correct permissions.

Question 49

How can we fix the permissions issue raised by using a bind mount?

Answer 49

By creating a new user group and adding it a new user whose ID matches the local user in the docker image using Linux command `groupadd` and `useradd`. ps. This can be done in the Dockerfile like so: ``` RUN groupadd -r --gid 1000 user \ && useradd -r --uid 1000 -g user user ``` Having built an image from the docker file containing these lines, when we bind the host directory into the container, we also specify on the command line that the container must run as the user we've created. ``` docker run --volume $(pwd):/src --user user ```

Question 50

What is the issue with the file/folder permissions that needs handling when working with bind mounts?

Answer 50

The default user in the container is the root user, whose user ID and group ID don't match the user developing the app. This mismatch can cause some unexpected behaviour. eg. If you create a file on the Docker host by using the touch command, you will se that the owner of this file is the local user. However, when we run a container that uses a bind mount and use the touch command inside the container, the owner of the created file will be the container's root user, which means that it's owned by the root user on host. If you try to write to this file, you can't. You don't have the correct permissions.

Question 51

How do you instruct Dockerfile to add a new system user group for the container image?

Answer 51

By using the `RUN` instruction to issue a Linux `groupadd` command with the `--system` option and specifying the group id using the `--gid` option, as well ass specifying the user group name. ``` RUN groupadd --system --gid 1000 usergroup ```

Question 52

How do you instruct Dockerfile to create a new system user add it to an existing user group for the container image?

Answer 52

By using the `RUN` instruction to issue a Linux `useradd` command with the `--system` option, specifying the user ID using the `--uid` option, and specifying the group ID or name using the `--gid` option, as well as specifying in the new user's name. ``` RUN ... \ && useradd --system --uid 1000 --gid usergroup user ```

Question 53

How do you define dynamic variables in a Dockerfile which you can use the Command-Line to overwrite?

Answer 53

By using the `ARG` instruction. ``` ARG UID=1000 ``` ps. You can then use this variable elsewhere in the Dockerfile. ``` $UID ``` ...and you can overwrite its value while running the `docker build` command by passing it in using the `--build-arg` option. ``` docker build --build-arg UID=1001 ... ```

Question 54

How do you publish a port on the container to a port on the host while using the `docker run` command?

Answer 54

By specifying the container's port to be published and the host's port for it to be published to using the `--publish` option. ``` docker run --publish 3000:3000 ```

Question 55

What option to the `docker run` command do we use to bind mount a volume?

Answer 55

`--volume`

Question 56

How do you specify what command to run in combination with the ENTRYPOINT instruction specified in Dockerfile while running a container image on the CLI?

Answer 56

By specifying the command after the container image name specification. ``` docker run ..... todo:1.0 dev ``` ``` ps. If the Dockerfile looks like: ``` ENTRYPOINT ["npm", "run"] CMD ["prod"] ``` ``` ...by default, it will run `npm run prod`. When we pass it the `dev` argument as seen above, it will instead run `npm run dev`.