diff --git a/docker_tuts/docker_network_notes.md b/docker_tuts/docker_network_notes.md new file mode 100644 index 00000000..a3e2020a --- /dev/null +++ b/docker_tuts/docker_network_notes.md @@ -0,0 +1,168 @@ +### An Introduction to Docker Networks + +Docker containers can "talk" to each other via a networking service known as a "docker bridge". +This acts very much like a central network server, or router, which takes the myriad of network +requests from various docker containers and "orchestrates" them, allowing docker containers to +interact. + +#### Creating A Basic Network From Scratch + +Creating a network instance involves the following command: + +```bash +docker network create web_server --driver +``` + +This will return a long hash that acts as the network id. + +We can inspect the status of this network, as well as how many containers are +running on this network via the following command: + +```bash +docker inspect web_server +``` + +This will return a JSON output, under the "Containers" field, you will see that +there are no containers currently running on this docker network. + +We can now demonstrate the basic interaction between two docker containers by +pulling in docker images, such as an nginx that provides an api to an alpine +linux server: + +```bash +docker pull nginx:1 && docker pull alpine:3 +``` + +Now let's use our images to create the server(nginx) and client(alpine) using +docker run. Note here how we specify the network using the '--network' flag: + +```bash +docker run -dit --name server --network web_server nginx:1 +``` + +```bash +docker run -dit --name server --network web_server alpine:3 +``` + +If we now reinvoke our docker inspect command, we will see under the +"Containers" field, we will see our two containers: + +```bash +docker inspect web_server +``` + +Let's go ahead and inspect our client server further by "entering" the container +using an interactive shell: + +```bash +docker attach client +``` + +Two test our interactivity, let's use the classic curl command to test the +network (ensure it is installed using alpine's package manager, apk): + +```bash +apk add curl && \ +curl http://server:80 +``` + +You should now see the default success page from nginx displayed as HTML +("Welcome to nginx!") + +You can escape the container using (ctrl+p+q), ...or just type exit?? + +We can now attach more clients to this established network very much like +before: + +```bash +docker run -dit --name client2 --network web_server alpine:3 && docker attach +client2 +``` + +```bash +apk add curl && \ +curl http://server +``` + +Detatch from this container, and running: + +```bash +docker inspect web_server +``` + +Should show the third container in the JSON output. + +You additionally can inspect all docker containers running on a network using +the following command: + +```bash +docker network ls +``` + +Which will output a more CSV style output similar to other docker ls commands. + +#### Creating a Basic Docker Network With Existing Containers + +Additionally we can set up a network between existing containers. + +Firstly, let's create a simple network called 'secure-network' like so: + +```bash +docker network create secure-network +``` + +Very similar to our above section, we will now take an nginx image and run it +over our new secure-network like so. This is assuming a container named 'finance' +has already been created. The name 'finance' here is to hammer home the point +that this container contains sensitive information that can only communicate +over our 'secure-network' docker network: + +```bash +docker run -d --name finance --network=secure-network nginx:latest +``` + +If we then print out our running docker containers, we should see that this +container is running: + +```bash +docker ps +``` + +Now if we inspect this container: + +```bash +docker inspect finance +``` + +We'll see a lengthy JSON output with data about our container. This includes the +"Networks" field, which instead of showing the default "bridge" subfield, it +should now show our custom "secure-network" as main subfield name under our +"Network" field (you can run docker inspect $OTHER_CONTAINER_NAME on a a +container that isn't running on a network, you will see that this field +is indeed "bridge"). + +We can now test the security of our network by entering one of our bridge +containers and testing the connection via ping. Copy the ipaddress located in +the subfield "IPAddress" of our finance container. Then enter another container +that is not on this secure_network, and is instead using the default bridge +network. From that container, attempt to ping the copied ipaddress and you will +note that you cannot, because the finance container is no longer exposed to the +host bridge network. + +If we wish to not isolate the docker container from the host network (we want to +directly expose the docker container's ports to the host), we can do so +by passing the 'host' field when we create our docker container like so: + +```bash +docker run -d --name host-demo --network=host nginx:latest +``` + +If we then inspect the host-demo: + +```bash +docker inspect host-demo +``` + +We'll see under the "Networks" field that the "IPAddress" field is blank, that +is because, as mentioned earlier, this docker container is exposed directly to +our host network.