Containers on Bill Glover

Docker Desktop (Mac) Unix Socket

hello@bill.dev (Bill) — Sat, 13 Apr 2024 18:37:00 +0000

Two of the tools in my container toolkit stopped working at some point recently. To demonstrate the issue, I first make sure that I have an image pulled locally.

bg@Bills-MBP ~ % docker image ls
REPOSITORY   TAG       IMAGE ID       CREATED       SIZE
golang       1.22      824aa3c1d42c   10 days ago   830MB
demo         latest    cf12555b1219   10 days ago   830MB

The first tool, Dive, started producing errors like this.

bg@Bills-MBP tmp % dive demo
Image Source: docker://demo
Fetching image... (this can take a while for large images)
Handler not available locally. Trying to pull 'demo'...
Using default tag: latest
Error response from daemon: pull access denied for demo, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
cannot fetch image
exit status 1

The image was present locally and the docker daemon definitely running. I logged out, logged in again and tried different accounts. When I first hit this error I assumed that this was an issue with Dive. The workaround I used was to export the image to a .tar file and then use dive to browse the disk image. But then I hit this error with Trivy.

Docker and LetsEncrypt

hello@bill.dev (Bill) — Thu, 20 Oct 2022 20:14:45 +0100

If you are running a private container registry and using a certificate provided by LetsEncrypt, make sure you are using fullchain.pem and not cert.pem. If you miss this, the Docker CLI will report that your certificate is signed by an unknown authority.

I have an instance of Harbor running as a private container registry. The certificate used by this instance is provided by LetsEncrypt and yet the Docker CLI refused to let me log in.

Copy Files to and from a Container

hello@bill.dev (Bill) — Tue, 24 May 2022 09:56:32 +0000

Problem: I needed to copy some database files into a container running on Kubernetes without modifying the image or restarting the parent Pod.

Solution: The Kubernetes CLI includes a sub-command for copying files into and out of a running container: kubectl cp /tmp/foo <some-pod>:/tmp/bar

Background

I’ve never found the need to copy files into a running container without issuing an updated image. This is somewhat of an anti-pattern as modifications to containerised filesystems that aren’t mounted externally are lost when the container process terminates.

Build Multi-Architecture Docker Images

hello@bill.dev (Bill) — Fri, 01 Apr 2022 19:22:32 +0000

Back in 2018, I wrote about Multi-Architecture Docker Builds. My main aim then was to run the occasional container image on a Raspberry Pi. Apple’s transition to M1 based machines has increased demand for multi-architecture container images. In this post, I document an improved approach to building multi-architecture images.

I’ll use a Go application to show the build process. It prints the current runtime OS and CPU architecture to the terminal and then exits.

Use Harbor to Avoid Docker Hub Rate Limits

hello@bill.dev (Bill) — Thu, 07 Jan 2021 11:00:00 +0000

In November, Docker implemented new rate limits for anonymous and free use of Docker Hub. They added two new limits:

Anonymous: 100 container image requests / six hours
Free Authenticated: 200 container image requests / six hours

If you find yourself operating above these limits, you have a few options. You can sign up for a Docker Pro or Team account, or you can reduce image request frequency below thresholds.

My Toolbox: Octant

hello@bill.dev (Bill) — Mon, 12 Oct 2020 10:00:00 +0000

We are constantly presented with new tools all the time; scripts, themes, or even code editors. We try them, we forget about them, and before you know it a brew update take minutes rather than seconds to run. The few tools that do tend to stick around are those that solve a real need. Octant is one such tool. It’s not just the latest addition to my toolbox, it’s one that I’m turning to with increasing regularity.

How I Manage Kubernetes Config

hello@bill.dev (Bill) — Fri, 12 Jun 2020 06:00:00 +0000

If you work with Kubernetes, you’ll be aware of the config file that defines contexts. This config is what kubectl uses to gain access to a cluster. I work with a large number of ephemeral clusters and have found that this config is difficult to manage. This post shows how I’ve switched to using individual config files for each cluster.

Dive Through the Layers

hello@bill.dev (Bill) — Fri, 28 Feb 2020 06:16:35 +0000

Dive Through the Layers

I’ve been working with a container image for a Django application and was surprised to find that an image for a simple application was 1.2 GB. This was particularly jarring as, coming from the world of Go, I’m used to images that come in at under 20 MB.

It’s not the size of the container image that’s the problem. Layer caching and re-use means that you are rarely transferring the full image around and that storage on disk is usually less than the sum of all your images. The worry I have with an image that is 1.2 GB is that everything that makes up that image needs to be maintained, patched, watched for security vulnerabilities, etc. 1.2 GB is a lot of software.

Docker Compose: Conditional Services

hello@bill.dev (Bill) — Fri, 21 Feb 2020 06:16:35 +0000

I recently added a docker-compose definition of services to make it easier for people to contribute to the new CodeBuddies back-end. This addresses some of the pain new contributors were feeling with setting up a local development environment. The CodeBuddies backend is an API built using the Django REST Framework. PostgreSQL provides the data store. Everything is fronted by an Nginx reverse proxy. This is often referred to as a three-tier architecture.

The Sidecar Pattern

hello@bill.dev (Bill) — Sun, 12 Jan 2020 08:16:35 +0000

The sidecar is a multi-container pattern used to provide additional functionality to a containerised-application without requiring changes to the application itself. The sidecar is the foundation of popular tools like the Istio service mesh. But how does it work?

In this post, I will demonstrate how to use the Sidecar pattern to add TLS termination to an existing application using a custom-built proxy server. In reality, there should be no reason to build everything from scratch, I’ve done so here to validate my understanding of how things work. This post has been written so that you can read along without implementing the examples, but if you want to get your hands dirty and code along, I’ve made a few assumptions: