Painless Docker: Unlock the Power of Docker and its Ecosystem, 2024 Edition

Table of Contents
Preface
	To Whom Is This Guide Addressed?
	How To Properly Enjoy This Guide
	Join the community
The Missing Introduction to Containerization
	We Are Made by History
	Jails, Virtual Private Servers, Zones, Containers, and VMs: What's the Difference Anyway?
	OS Containers vs. App Containers
	Docker: Container or Platform?
	The Open Container Initiative: What is a Standard Container?
	A Deep Dive into Container Prototyping with runC
	Industry Standard Container Runtimes
	containerd, shim and runC: How Everything Works Together
	Adding a New Runtime to Docker
	Does CRI Mean the Death of Docker?
	The Moby Project
Installing and Using Docker
	Installing Docker
	Docker CLI
Docker Events
	Using Docker API To List Events
Docker Containers
	Creating Containers
	Running Containers
	Restarting Containers
	Pausing and Unpausing Containers
	Stopping Containers
	Killing Containers
	Removing Containers
	Container Lifecycle
	Starting Containers Automatically
	Accessing Containers Ports
	Running Docker In Docker
Managing Containers Resources
	Memory Usage Reservations and Limits
	CPU Usage Reservations and Limits
Docker Images
	What is an Image?
	Images are Layers
	Images, Intermediate Images & Dangling Images
	The Dockerfile and its Instructions
	The Base Image
	Extending the Base Image
	Exploring Images' Layers
	Building an Image Using a Dockerfile
	Creating Images out of Containers
	Migrating a VM to a Docker Image
	Creating and Understanding the Scratch Image
Docker Hub and Docker Registry
	Docker Hub, Public and Private Registries
	Docker Hub: The Official Docker Registry
	Using Docker Hub
	DockerHub Alternatives
	Creating a Private Docker Registry
Optimizing Docker Images
	Less Layers = Faster Builds?
	Is There a Maximum Number of Layers?
	Optimizing Dockerfile Layer Caching for Dependency Management
	The Multi-Stage Build
	Smaller Images
	Other Techniques: Squashing, Distroless, etc
Docker Volumes
	What is a Docker Volume?
	Creating and Using Docker Volumes
	Listing and Inspecting Docker Volumes
	Named Volumes vs Anonymous Volumes
	Bind Mounts
	Data Propagation
	Dangling Volumes
	TMPFS Mounts
	Docker Volume From Containers
Docker Logging
	How Docker Logs Work
	Logging Best Practices and Recommendations
	Logging Drivers
	Docker Daemon Logging
Docker Networks
	Docker Networks Types
	The (System) Bridge Network
	The (User) Bridge Network
	The Host Network
	The None Network
	The Macvlan Network
	The Overlay Network
	The Ingress Network
	Docker Links
Docker Compose
	What is Docker Compose and Why Should I Care?
	Installing Docker Compose
	Understanding Docker Compose and How it Works
	Docker Compose Dependencies
	Creating Portable Docker Compose Stacks
	Docker Compose Logging
	Understanding Docker Compose Syntax
	Using Dockerfile with Docker Compose
	Docker Compose with Bind Mounts
	Creating Custom Networks
	Docker Compose Secrets
	Scaling Docker Compose Services
Cleaning Docker
	Delete Volumes
	Delete Networks
	Delete Images
	Remove Docker Containers
	Cleaning Up Everything
Docker Plugins
Orchestration - Docker Swarm
	What is Docker Swarm?
	Creating a Swarm Cluster
	Swarm Services and Tasks
	Networking in Docker Swarm
	Performing Operations on Nodes
	Multi-manager Docker Swarm
	Docker Swarm Environment Variables and Secrets
	Docker Swarm Volumes
	Deploying a WordPress Application on Docker Swarm
	Docker Swarm Global Services
	Docker Swarm Resouce Management
	Docker Swarm Stacks
	Docker Swarm Rolling Updates
	Using an External Load Balancer with Docker Swarm
	Using Traefik as a Front-End Load Balancer with Docker Swarm
	Docker Swarm Logging
	Docker Swarm vs. Kubernetes
Docker Desktop
	What is Docker Desktop?
	How to Install Docker Desktop
Common Security Threats
	Docker vs. VMs: Which is more secure?
	Kernel Panic & Exploits
	Container Breakouts & Privilege Escalation
	Poisoned Images
	Denial-of-service Attacks
	Compromising secrets
	Application Level Threats
	Host System Level Treats
Docker Security Best Practices
	Implement Security by Design
	setuid/setgid Binaries
	Control Resources
	Use Notary to Verify Image Integrity
	Scan Images
	Set Container Filesystem to Read Only
	Set Volumes to Read-Only
	Do Not Use the Root User
	Run the Docker Daemon in Rootless Mode
	Do Not Use Environment Variables For Sensitive Data
	Use Secret Management Tools
	Do Not Run Containers in the Privileged Mode
	Turn Off Inter-Container Communication
	Only Install Necessary Packages
	Make Sure Docker is up to Date
	Security Through Obscurity
	Use Limited Linux Capabilities
	Use Seccomp
	Use AppArmor
	Use SELinux
Docker API
	Docker SDKs
	Docker API: Hello World
	Prototyping a Log Collector Service
Debugging And Troubleshooting
	Docker Daemon Logs
	Activating Debug Mode
	Debugging Docker Objects
	Troubleshooting Docker Using Sysdig
The Ultimate Docker Cheat Sheet
	Installation
	Docker Registries & Repositories
	Running Containers
	Starting & Stopping Containers
	Getting Information about Containers
	Managing Images
	Networking
	Cleaning Docker
	Docker Swarm
	Docker Scout Suite
	Resources
Afterword
	What's next?
	Thank you
	About the author
	Join the community
	Feedback