🐳 Module 4: Containers and Docker

📋 Copy# Download image from Docker Hub
docker pull python:3.11

# With specific tag
docker pull python:3.11-slim

# Show all local images
docker images

# Delete image
docker rmi python:3.11

# Clean up unused images
docker image prune -a

📋 Copy# Start container interactively (with terminal)
docker run -it python:3.11 bash

# Start container in the background
docker run -d --name my-python python:3.11 sleep infinity

# Container with automatic deletion after exit
docker run --rm -it python:3.11 python -c "print('Hello!')"

# Show running containers
docker ps

# All containers (including stopped)
docker ps -a

# Stop container
docker stop my-python

# Start container (after stop)
docker start my-python

# Delete container
docker rm my-python

# Delete all stopped containers
docker container prune

📋 Copy# Open shell in running container
docker exec -it my-python bash

# Execute a single command
docker exec my-python cat /etc/os-release

# Log in as root (if user is different)
docker exec -it --user root my-python bash

📋 Copy# Mount directory into container (Bind Mount)
docker run -it -v ${PWD}:/workspace python:3.11 bash

# Create and use named volume
docker volume create my-volume
docker run -it -v my-volume:/data python:3.11 bash

# Copy file into container
docker cp local-file.txt my-python:/tmp/

# Copy file from container
docker cp my-python:/tmp/result.txt ./

📋 Copy# Port forwarding (Host:Container)
docker run -d -p 8080:80 nginx

# Container in host network (no NAT)
docker run --network host nginx

# Create custom network
docker network create my-network

# Start container in network
docker run -d --network my-network --name web nginx

# Show networks
docker network ls

📋 Copy# Base image: Slim Python
FROM python:3.11-slim

# Metadata
LABEL maintainer="netzwerk-team@firma.de"
LABEL description="Python mit Netzwerk-Automatisierungs-Tools"

# Install system packages
RUN apt-get update && apt-get install -y --no-install-recommends \
    openssh-client \
    iputils-ping \
    dnsutils \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Install Python packages
COPY requirements.txt /tmp/
RUN pip install --no-cache-dir -r /tmp/requirements.txt

# Working directory
WORKDIR /workspace

# Default command
CMD ["python3"]

📋 Copynetmiko==4.2.0
napalm==4.1.0
paramiko==3.4.0
netaddr==0.9.0
jinja2==3.1.2
pyyaml==6.0.1
requests==2.31.0
nornir==3.4.1
nornir-netmiko==1.0.1

📋 Copy# Build image (in directory with Dockerfile)
docker build -t network-tools:latest .

# Tag with version
docker build -t network-tools:1.0.0 .

# Tag for GitLab Registry
docker build -t 198.18.133.100:5050/workshop/network-tools:1.0.0 .

# Ignore build cache (clean build)
docker build --no-cache -t network-tools:latest .

📋 Copy# Bind Mount: Mount local directory
docker run -it -v ${PWD}:/workspace python:3.11 bash

# Create and use named volume
docker volume create ansible-data
docker run -it -v ansible-data:/data python:3.11 bash

# Inspect volume
docker volume inspect ansible-data

# Show all volumes
docker volume ls

# Delete unused volumes
docker volume prune

📋 Copy# Ansible Container für NDFC/Netzwerk-Automatisierung
FROM python:3.11-slim

# Labels für Wartbarkeit
LABEL maintainer="netzwerk-team@firma.de"
LABEL version="1.0"
LABEL description="Ansible mit Cisco DCNM/NDFC Collections"

# Umgebungsvariablen
ENV ANSIBLE_HOST_KEY_CHECKING=False
ENV ANSIBLE_RETRY_FILES_ENABLED=False
ENV PYTHONUNBUFFERED=1

# System-Abhängigkeiten
RUN apt-get update && apt-get install -y --no-install-recommends \
    openssh-client \
    sshpass \
    git \
    && rm -rf /var/lib/apt/lists/*

# Python-Pakete installieren
RUN pip install --no-cache-dir \
    ansible-core==2.15.* \
    ansible-pylibssh \
    jmespath \
    netaddr \
    requests \
    paramiko

# Ansible Collections installieren
RUN ansible-galaxy collection install \
    cisco.dcnm \
    ansible.netcommon \
    ansible.utils

# Arbeitsverzeichnis
WORKDIR /ansible

# Ansible-Version anzeigen beim Start
CMD ["ansible", "--version"]

📋 Copy# Build image
docker build -t ansible-ndfc:1.0 -f Dockerfile.ansible .

# Check Ansible version
docker run --rm ansible-ndfc:1.0

# Run playbook (with mounted files)
docker run --rm \
    -v ${PWD}:/ansible \
    -v $env:USERPROFILE.ssh:/root/.ssh:ro \
    ansible-ndfc:1.0 \
    ansible-playbook -i inventory.yml playbook.yml

# Interactive for testing
docker run -it --rm \
    -v ${PWD}:/ansible \
    ansible-ndfc:1.0 bash

📋 Copyversion: '3.8'

services:
  # Service 1: Web application
  web:
    image: nginx:alpine
    ports:
      - "8080:80"
    volumes:
      - ./html:/usr/share/nginx/html:ro
    depends_on:
      - api

  # Service 2: API Backend
  api:
    build: ./api
    environment:
      - DATABASE_URL=postgres://db:5432/app
    depends_on:
      - db

  # Service 3: Database
  db:
    image: postgres:15
    environment:
      POSTGRES_PASSWORD: secret
    volumes:
      - db-data:/var/lib/postgresql/data

volumes:
  db-data:

📋 Copy# Start all services
docker compose up

# Start in the background
docker compose up -d

# Show logs
docker compose logs -f

# Check status
docker compose ps

# Connect to a service
docker compose exec web sh

# Stop everything
docker compose down

# Stop and delete volumes
docker compose down -v

📋 Copyversion: '3.8'

services:
  # Ansible Automation Container
  ansible:
    build: .
    volumes:
      - ./playbooks:/ansible/playbooks
      - ./inventory:/ansible/inventory
      - ./group_vars:/ansible/group_vars
      - $env:USERPROFILE.ssh:/root/.ssh:ro
    environment:
      - ANSIBLE_HOST_KEY_CHECKING=False
      - NDFC_HOST=${NDFC_HOST}
      - NDFC_USER=${NDFC_USER}
      - NDFC_PASSWORD=${NDFC_PASSWORD}
    working_dir: /ansible
    command: tail -f /dev/null  # Keep container alive

  # Git server for local tests (optional)
  gitea:
    image: gitea/gitea:latest
    ports:
      - "3000:3000"
    volumes:
      - gitea-data:/data

volumes:
  gitea-data:

📋 Copy# Show logs of a container
docker logs container-name

# Live logs (like tail -f)
docker logs -f container-name

# Last 100 lines
docker logs --tail 100 container-name

# With timestamps
docker logs -t container-name

# Logs since a specific time
docker logs --since 10m container-name

📋 Copy# All info about a container
docker inspect container-name

# Extract specific info (IP address)
docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' container-name

# Show environment variables
docker inspect -f '{{range .Config.Env}}{{println .}}{{end}}' container-name

# Show mounted volumes
docker inspect -f '{{range .Mounts}}{{.Source}} -> {{.Destination}}{{println}}{{end}}' container-name

📋 Copy# Open shell in container
docker exec -it container-name bash
# Or for Alpine-based images:
docker exec -it container-name sh

# Log in as root
docker exec -it --user root container-name bash

# Show processes in container
docker exec container-name ps aux

# Check network status
docker exec container-name netstat -tlnp
docker exec container-name cat /etc/resolv.conf

📋 Copy# Live statistics for all containers
docker stats

# For specific containers
docker stats container-name

# One-time (not live)
docker stats --no-stream

📋 Copy# ✅ GOOD: Use specific version
FROM python:3.11.7-slim-bookworm

# ✅ GOOD: Combined RUN commands (fewer layers)
RUN apt-get update && apt-get install -y --no-install-recommends \
    openssh-client \
    && rm -rf /var/lib/apt/lists/*

# ✅ GOOD: Requirements first (leverage cache)
COPY requirements.txt /tmp/
RUN pip install --no-cache-dir -r /tmp/requirements.txt

# ✅ GOOD: Code last (changes often)
COPY . /app

# ✅ GOOD: Non-root user
RUN useradd -m appuser
USER appuser

# ✅ GOOD: Define HEALTHCHECK
HEALTHCHECK --interval=30s --timeout=3s \
    CMD curl -f http://localhost:8080/health || exit 1

📋 Copy# Stage 1: Build
FROM python:3.11 AS builder

COPY requirements.txt .
RUN pip wheel --no-cache-dir --wheel-dir /wheels -r requirements.txt

# Stage 2: Runtime (slim)
FROM python:3.11-slim

COPY --from=builder /wheels /wheels
RUN pip install --no-cache-dir /wheels/*

COPY app/ /app/
CMD ["python", "/app/main.py"]

📋 Copystages:
  - build
  - test
  - deploy

variables:
  IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA

build-image:
  stage: build
  image: docker:24
  services:
    - docker:24-dind
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build -t $IMAGE_TAG .
    - docker push $IMAGE_TAG

run-ansible:
  stage: deploy
  image: $IMAGE_TAG
  script:
    - ansible-playbook -i inventory.yml playbook.yml
  only:
    - main

📋 Copy# Git
.git
.gitignore

# IDE
.vscode
.idea
*.swp

# Python
__pycache__
*.pyc
.pytest_cache
.venv
venv

# Secrets (NEVER include in the image!)
*.pem
*.key
.env
secrets/

# Build artifacts
*.log
.coverage
htmlcov/