{"id":889,"date":"2019-10-06T02:32:49","date_gmt":"2019-10-06T02:32:49","guid":{"rendered":"https:\/\/www.devsecops.ltd\/?p=889"},"modified":"2024-05-24T15:39:04","modified_gmt":"2024-05-24T15:39:04","slug":"lesson-2-docker-images-docker-layers-and-registry","status":"publish","type":"post","link":"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/","title":{"rendered":"Lesson 2: Docker Images, Docker Layers, and Registry"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_67_1 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title \" >Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Introduction\" title=\"Introduction\">Introduction<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Docker_Image_vs_Docker_Container\" title=\"Docker Image vs Docker Container\">Docker Image vs Docker Container<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Dockerfile\" title=\"Dockerfile\">Dockerfile<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Docker_Image_creation_using_Dockerfile\" title=\"Docker Image creation using Dockerfile\">Docker Image creation using Dockerfile<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Docker_Image_Layers\" title=\"Docker Image Layers\">Docker Image Layers<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Why_Docker_uses_layers\" title=\"Why Docker uses layers?\u00a0\">Why Docker uses layers?\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Task\" title=\"Task\u00a0\">Task\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Docker_Registry_and_Docker_Hub\" title=\"Docker Registry and Docker Hub\">Docker Registry and Docker Hub<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Docker_Registry\" title=\"Docker Registry\">Docker Registry<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Docker_Hub\" title=\"Docker Hub\">Docker Hub<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Task-2\" title=\"Task\">Task<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Self-hosted_Docker_registry\" title=\"Self-hosted Docker registry\">Self-hosted Docker registry<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Task-3\" title=\"Task\">Task<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Reference\" title=\"Reference\">Reference<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Conclusion\" title=\"Conclusion\">Conclusion<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/#Appendix_A\" title=\"Appendix A\">Appendix A<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"Introduction\"><\/span><b>Introduction<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>In the previous lesson, we have learned the advantages and disadvantages of docker. We also configured the lab environment and looked at a hello world docker example.<\/p>\n<p>In this lesson, we are going to dig deeper into Docker, Docker images and its commands. We will also be doing a couple of tasks where you will be tinkering with docker rather than just copy-pasting the commands.<\/p>\n<p>Before moving on with this lesson, let us first clarify one of the most commonly asked questions \u201cwhat&#8217;s the difference between docker images and docker containers?\u201d<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Docker_Image_vs_Docker_Container\"><\/span><b>Docker Image vs Docker Container<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Docker Image is a template aka blueprint to create a running Docker container. Docker uses the information available in the Image to create (run) a container.<\/p>\n<p>If you are familiar with programming, you can think of an image as a class and a container is an instance of that class.<\/p>\n<p>An image is a static entity and sits on the disk as a tarball (zip file), whereas a container is a dynamic (running, not static) entity. So you can run multiple containers of the same image.<\/p>\n<p>In short, a running form of an image is a container.<\/p>\n<p>Let\u2019s see both images and containers in action using Docker CLI<\/p>\n<blockquote><p><span style=\"color: #e02b20;\"><strong>If you are our paid customer and taking any of our courses like CDE\/CDP\/CCSE\/CCNSE, please use the browser based lab portal to do all the exercises and do not use the below Virtual Machine.<\/strong>\u00a0<\/span><\/p><\/blockquote>\n<p>The below command lists images present in the local machine.<\/p>\n<blockquote>\n<pre>$ docker images<\/pre>\n<\/blockquote>\n<p><span style=\"font-weight: 300;\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-919 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-helloworld.png\" alt=\"\" width=\"855\" height=\"149\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-helloworld.png 638w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-helloworld-300x52.png 300w\" sizes=\"(max-width: 855px) 100vw, 855px\" \/><\/span><\/p>\n<p><span style=\"font-size: 15px;\">You can create a container from this image by using the docker run command.<\/span><\/p>\n<blockquote>\n<pre>$ docker run hello-world<\/pre>\n<\/blockquote>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-911 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_run_helloworld.png\" alt=\"\" width=\"862\" height=\"522\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_run_helloworld.png 629w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_run_helloworld-300x182.png 300w\" sizes=\"(max-width: 862px) 100vw, 862px\" \/><\/p>\n<p><span style=\"font-size: 15px;\">In order to perform security assessments of the Docker ecosystem, you need to understand Docker images and containers in more detail.\u00a0<\/span><\/p>\n<p><span style=\"font-size: 15px;\">Let&#8217;s explore these topics in depth.<\/span><\/p>\n<p><b style=\"color: #333333; font-size: 30px;\">Docker Image<\/b><\/p>\n<p><span style=\"font-size: 15px;\">We already know that the Docker image is a template used to create(run) a docker container but what it\u2019s made of ? what it takes to create it? and what information is needed to turn an image into a container?<\/span><\/p>\n<h2><span class=\"ez-toc-section\" id=\"Dockerfile\"><\/span><b>Dockerfile<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Docker images are usually created with the help of a Docker specific file called Dockerfile. Dockerfile contains step by step instructions to create an Image.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-927 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-workflow.png\" alt=\"\" width=\"1920\" height=\"1080\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-workflow.png 1920w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-workflow-300x169.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-workflow-768x432.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-workflow-1024x576.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-workflow-1080x608.png 1080w\" sizes=\"(max-width: 1920px) 100vw, 1920px\" \/><\/p>\n<p>As we can see, a Dockerfile is used to create a Docker image, this image is then used for the creation of a Docker container.<\/p>\n<p>A simple example of a Dockerfile is shown below.<\/p>\n<blockquote>\n<pre># Dockerfile for creating a nmap alpine docker Image\r\n FROM alpine:latest\r\n RUN apk update\r\n RUN apk add nmap\r\n ENTRYPOINT [\"nmap\"]\r\n CMD [\"localhost\"]<\/pre>\n<\/blockquote>\n<p>Let\u2019s explore what these Dockerfile instructions mean.<\/p>\n<p><strong>FROM<\/strong>: This instruction in the Dockerfile tells the daemon, which base image to use while creating our new Docker image. In the above example, we are using a very minimal OS image called alpine (just 5 MB of size). You can also replace it with Ubuntu, Fedora, Debian or any other OS image.<\/p>\n<p><strong>CMD<\/strong>: The CMD sets default command and\/or parameters when a docker container runs. CMD can be overwritten from the command line via the docker run command.<\/p>\n<p><strong>ENTRYPOINT<\/strong>: The ENTRYPOINT instruction is used when you would like your container to run the same executable every time. Usually, ENTRYPOINT is used to specify the binary and CMD to provide parameters.<\/p>\n<p><strong>RUN<\/strong>: This command instructs the Docker daemon to run the given commands as it is while creating the image. A Dockerfile can have multiple RUN commands, each of these RUN commands create a new layer in the image.<\/p>\n<p>For example, if you have the following Dockerfile.<\/p>\n<blockquote>\n<pre># Dockerfile for creating a nmap alpine docker Image\r\n FROM alpine:latest\r\n RUN apk update\r\n RUN apk add nmap\r\n ENTRYPOINT [\"nmap\"]\r\n CMD [\"-h\", \"localhost\"]<\/pre>\n<\/blockquote>\n<p>The FROM instruction will create one layer, the first RUN command will create another layer, the second RUN command, one more layer and finally, CMD will create the last layer.<\/p>\n<p>The below example shows the same above example on a ubuntu base image.<\/p>\n<blockquote>\n<pre># Dockerfile for creating a nmap ubuntu docker Image\r\n FROM ubuntu:latest\r\n RUN apt-get update\r\n RUN apt-get install nmap -y\r\n ENTRYPOINT [\"nmap\"]\r\n CMD [\"-h\", \"localhost\"]<\/pre>\n<\/blockquote>\n<p><strong>COPY<\/strong>: This command copies files from the host machine into the image.<\/p>\n<p><strong>ADD<\/strong>: The ADD command is similar to COPY but provides two more advantages.<br \/>\nIt supports URLs so we can directly download files from the internet.<br \/>\nIt also supports auto extraction.<\/p>\n<p><strong>WORKDIR<\/strong>: This command will specify on which directory the commands have to be executed. You could think of this as the cd command in *nix based operating systems<\/p>\n<p><strong>EXPOSE<\/strong>: The EXPOSE command exposes the container port.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-930 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-ticked.png\" alt=\"\" width=\"1920\" height=\"1080\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-ticked.png 1920w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-ticked-300x169.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-ticked-768x432.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-ticked-1024x576.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-ticked-1080x608.png 1080w\" sizes=\"(max-width: 1920px) 100vw, 1920px\" \/><\/p>\n<p>Enough of theory, let\u2019s build a simple docker-image which runs Nmap against localhost.<\/p>\n<blockquote><p><span style=\"color: #e02b20;\"><strong>If you are our paid customer and taking any of our courses like CDE\/CDP\/CCSE\/CCNSE, please use the browser based lab portal to do all the exercises and do not use the below Virtual Machine.<\/strong>\u00a0<\/span><\/p>\n<p>&nbsp;<\/p><\/blockquote>\n<h2><span class=\"ez-toc-section\" id=\"Docker_Image_creation_using_Dockerfile\"><\/span><b>Docker Image creation using Dockerfile<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Start your VM and open the Leafpad text editor by going to Start Menu \u2192 Accessories \u2192 Leafpad and paste the below code.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-936 aligncenter\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/Leafpad.png\" alt=\"\" width=\"499\" height=\"355\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/Leafpad.png 724w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/Leafpad-300x214.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/Leafpad-400x284.png 400w\" sizes=\"(max-width: 499px) 100vw, 499px\" \/><\/p>\n<p><span style=\"font-size: 15px;\">\u00a0<\/span># Dockerfile for creating a nmap alpine docker Image<\/p>\n<pre> FROM alpine:latest\r\n RUN apk update\r\n RUN apk add nmap\r\n ENTRYPOINT [\"nmap\"]\r\n CMD [\"-h\", \"localhost\"]<\/pre>\n<p>Save the file (File \u2192 Save) with the name Dockerfile with no extension.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-929 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-save.png\" alt=\"\" width=\"643\" height=\"457\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-save.png 1590w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-save-300x213.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-save-768x546.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-save-1024x728.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-save-400x284.png 400w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-save-1080x768.png 1080w\" sizes=\"(max-width: 643px) 100vw, 643px\" \/><\/p>\n<p>Let&#8217;s use this Dockerfile to build the Nmap image.<\/p>\n<p>Open the terminal and go to the directory where the Dockerfile exists then execute the following command.<\/p>\n<blockquote>\n<pre>$ docker build -t mynmap .<\/pre>\n<\/blockquote>\n<p>Here the <strong>-t<\/strong> stands for a tag, a human-readable name for our container.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-914 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-build-mynmap.png\" alt=\"\" width=\"1420\" height=\"956\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-build-mynmap.png 1420w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-build-mynmap-300x202.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-build-mynmap-768x517.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-build-mynmap-1024x689.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-build-mynmap-1080x727.png 1080w\" sizes=\"(max-width: 1420px) 100vw, 1420px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-932 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/image-checksum.png\" alt=\"\" width=\"1420\" height=\"956\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/image-checksum.png 1420w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/image-checksum-300x202.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/image-checksum-768x517.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/image-checksum-1024x689.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/image-checksum-1080x727.png 1080w\" sizes=\"(max-width: 1420px) 100vw, 1420px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-size: 15px;\">Congratulations, you just created a brand new image from the Dockerfile \ud83d\ude42<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-928 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-image.png\" alt=\"\" width=\"1920\" height=\"1080\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-image.png 1920w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-image-300x169.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-image-768x432.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-image-1024x576.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerfile-image-1080x608.png 1080w\" sizes=\"(max-width: 1920px) 100vw, 1920px\" \/><\/p>\n<p>You can use <strong>docker images<\/strong> command to verify the <strong>mynmap<\/strong> image got created.<\/p>\n<blockquote>\n<pre>$ docker images<\/pre>\n<\/blockquote>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-918 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-3.png\" alt=\"\" width=\"1576\" height=\"250\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-3.png 1576w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-3-300x48.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-3-768x122.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-3-1024x162.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-3-1080x171.png 1080w\" sizes=\"(max-width: 1576px) 100vw, 1576px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>You can see, the <strong>mynmap<\/strong> image with image id &#8220;<strong>116934ec082f<\/strong>&#8221; is present. Also, do keep in mind the alpine&#8217;s image ID, we will come back to it shortly.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Docker_Image_Layers\"><\/span><b>Docker Image Layers<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>When we execute the build command, the daemon reads the Dockerfile and creates a layer for every command.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-934 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layer-checksum.png\" alt=\"\" width=\"1920\" height=\"1080\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layer-checksum.png 1920w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layer-checksum-300x169.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layer-checksum-768x432.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layer-checksum-1024x576.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layer-checksum-1080x608.png 1080w\" sizes=\"(max-width: 1920px) 100vw, 1920px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>Let&#8217;s try to find the layers on the container, we just created. We can use the docker image history command to see image layers.<\/p>\n<blockquote>\n<pre>$ docker image history mynmap<\/pre>\n<\/blockquote>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-916 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-history-mynmap.png\" alt=\"\" width=\"1570\" height=\"270\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-history-mynmap.png 1570w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-history-mynmap-300x52.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-history-mynmap-768x132.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-history-mynmap-1024x176.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-history-mynmap-1080x186.png 1080w\" sizes=\"(max-width: 1570px) 100vw, 1570px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>In the above output, we have about <strong>5 lines<\/strong> (please ignore the last &lt;missing&gt; line for now). How many instructions do we have in our Dockerfile? <strong>Five<\/strong>.<\/p>\n<p>If you look closely, each layer corresponds to an instruction in the Dockerfile.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-933 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layer-checksum-sha.png\" alt=\"\" width=\"1920\" height=\"1080\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layer-checksum-sha.png 1920w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layer-checksum-sha-300x169.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layer-checksum-sha-768x432.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layer-checksum-sha-1024x576.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layer-checksum-sha-1080x608.png 1080w\" sizes=\"(max-width: 1920px) 100vw, 1920px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>The &lt;missing&gt; line and the <strong>961769676411<\/strong> layer above it (#(nop) CMD &#8220;bin\/sh&#8221;) are of the alpine:latest. How do I know that? let&#8217;s re-run docker images command.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"1576\" height=\"250\" class=\"wp-image-918 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-3.png\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-3.png 1576w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-3-300x48.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-3-768x122.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-3-1024x162.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-3-1080x171.png 1080w\" sizes=\"(max-width: 1576px) 100vw, 1576px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>As you can see, the image id for alpine image is <strong>961769676411<\/strong> so, the first layer is the alpine image.<\/p>\n<p>The &lt;missing&gt; line means that alpine image layers are built on a different system and are not available on our lab machine.<\/p>\n<p>Also, these layers are read-only(hello immutability). When you run a container, the docker daemon creates a readable\/writeable layer (aka container layer) on top of these read-only layers.<\/p>\n<p>The docker image history doesn&#8217;t always show uniform information e.g., when you pull the image from the docker hub (more on docker hub later) instead of creating it locally.<\/p>\n<p>For this reason, we are going to use a tool called, <strong>Dive tool<\/strong> which takes care of various scenarios and shows a uniform output.<\/p>\n<p>Let&#8217;s go ahead and install this tool by opening up a terminal and executing the following commands.<\/p>\n<blockquote>\n<pre>$wget https:\/\/github.com\/wagoodman\/dive\/releases\/download\/v0.8.1\/dive_0.8.1_linux_amd64.deb<\/pre>\n<\/blockquote>\n<p>The above command downloads the Dive tool. Install the downloaded dive package by using sudo privileges (use password docker when prompted)<\/p>\n<blockquote>\n<pre>$ sudo apt install .\/dive_0.8.1_linux_amd64.deb -y<\/pre>\n<\/blockquote>\n<p>Let&#8217;s try to use the tool on the mynmap image, using the following syntax.<\/p>\n<blockquote>\n<pre>$ dive mynmap<\/pre>\n<\/blockquote>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-935 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layers-without-nop.png\" alt=\"\" width=\"1572\" height=\"1046\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layers-without-nop.png 1572w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layers-without-nop-300x200.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layers-without-nop-768x511.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layers-without-nop-1024x681.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/layers-without-nop-1080x719.png 1080w\" sizes=\"(max-width: 1572px) 100vw, 1572px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><strong>What<\/strong>? why do we have 3 layers now instead of 5? Those are still there, just that the Dive tool doesn&#8217;t show them as its a no-operation (nop). If you revisit the following output, you will see there is a #(nop) in some of the instructions.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-916 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-history-mynmap.png\" alt=\"\" width=\"1570\" height=\"270\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-history-mynmap.png 1570w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-history-mynmap-300x52.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-history-mynmap-768x132.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-history-mynmap-1024x176.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-history-mynmap-1080x186.png 1080w\" sizes=\"(max-width: 1570px) 100vw, 1570px\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Why_Docker_uses_layers\"><\/span><b>Why Docker uses layers?\u00a0<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Now, you might ask, why build an image with multiple layers when we can just built it in a single layer?<\/p>\n<p>Let&#8217;s take an example to explain this concept better, let us try to change the Dockerfile we created and this time instead of scanning the localhost, let&#8217;s scan 127.0.0.1.<\/p>\n<p>Once you have made this change in the Dockerfile, it should be as follows.<\/p>\n<blockquote>\n<pre># Dockerfile for creating a nmap alpine docker Image\r\n FROM alpine:latest\r\n RUN apk update\r\n RUN apk add nmap\r\n ENTRYPOINT [\"nmap\"]\r\n CMD [\"-h\", \"127.0.0.1\"]<\/pre>\n<\/blockquote>\n<p>Now, rebuild the image using docker build.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-913 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-build-mynmap-cache.png\" alt=\"\" width=\"1572\" height=\"742\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-build-mynmap-cache.png 1572w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-build-mynmap-cache-300x142.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-build-mynmap-cache-768x363.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-build-mynmap-cache-1024x483.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-build-mynmap-cache-1080x510.png 1080w\" sizes=\"(max-width: 1572px) 100vw, 1572px\" \/><br \/>\nAs you can see that the image was built using the existing layers from our previous docker image builds. If some of these layers are being used in other containers, they can just use the existing layer instead of recreating it from scratch<\/p>\n<p><span style=\"font-size: 15px;\">This provides a few benefits for us.<\/span><\/p>\n<ol>\n<li>Efficient disk\/image storage without creating duplicates.<\/li>\n<li>Faster image creation as we don&#8217;t have to rebuild them on every build.<\/li>\n<li>Reduces image download size if the layers already exist on the local machine.<\/li>\n<\/ol>\n<p>That&#8217;s why Docker uses multiple layers instead of a single layer.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-931 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerimage-ticked.png\" alt=\"\" width=\"1920\" height=\"1080\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerimage-ticked.png 1920w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerimage-ticked-300x169.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerimage-ticked-768x432.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerimage-ticked-1024x576.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/dockerimage-ticked-1080x608.png 1080w\" sizes=\"(max-width: 1920px) 100vw, 1920px\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Task\"><\/span><b>Task\u00a0<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Use the <a href=\"https:\/\/github.com\/P3GLEG\/Whaler\">whaler tool<\/a> on the mynmap image and explore various features provided by the tool. Write down, how this tool is different than the Dive tool.<\/p>\n<p><strong>Installation Instruction for Whaler.<\/strong><\/p>\n<p><strong>Step 1<\/strong>: Download the Binary.<\/p>\n<blockquote>\n<pre>$wget https:\/\/github.com\/P3GLEG\/Whaler\/releases\/download\/1.0\/Whaler_linux_amd64<\/pre>\n<\/blockquote>\n<p><strong>Step 2:<\/strong> Give executable permissions to the downloaded whaler binary.<\/p>\n<blockquote>\n<pre>$ chmod +x Whaler_linux_amd64<\/pre>\n<\/blockquote>\n<p><strong>Step 3<\/strong>: Run whaler on the docker image.<\/p>\n<p><strong>Usage<\/strong><\/p>\n<blockquote>\n<pre>$ .\/Whaler_linux_amd64 &lt;image-name&gt;<\/pre>\n<\/blockquote>\n<p><strong>Note<\/strong>: You can create docker images in another way, please see <strong>Appendix A<\/strong> for more details.<\/p>\n<p>So far, we have seen Dockerfile and how it can be used to create docker images, but how do we share these images with others in the organization, world, etc.,<\/p>\n<p>This is where the concept of the docker registry comes into the picture.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Docker_Registry_and_Docker_Hub\"><\/span><b>Docker Registry and Docker Hub<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"Docker_Registry\"><\/span><b>Docker Registry<\/b><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>A Docker Registry is a storage and distribution system for named docker images.<\/p>\n<p>In simple terms, a registry is a software service(app store) to store and share docker images.<\/p>\n<p>Docker stores docker images into repositories. Each repository can have multiple versions of an image e.g., nginx:1.14, nginx:1.15, etc., If no image version is given, the latest is used by default.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-910 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/change-my-mind.png\" alt=\"\" width=\"982\" height=\"735\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/change-my-mind.png 577w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/change-my-mind-300x225.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/change-my-mind-510x382.png 510w\" sizes=\"(max-width: 982px) 100vw, 982px\" \/><\/p>\n<p><span style=\"font-size: 15px;\">The Docker registries can be private or public, self-hosted or cloud-based.\u00a0<\/span><span style=\"font-size: 15px;\">You can use cloud-based registries or deploy your own docker registries.<\/span><\/p>\n<p>They both have pros and cons, let&#8217;s explore them briefly.<\/p>\n<table width=\"627\">\n<tbody>\n<tr>\n<td style=\"width: 304px;\"><strong>Self-hosted (aka internal)<\/strong><\/td>\n<td style=\"width: 307px;\"><strong>Cloud-based (aka public)<\/strong><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 304px;\">Single-tenant, more secure as they are internal to an organization.<\/td>\n<td style=\"width: 307px;\">Multi-tenant, might not be as secure as internal registries.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 304px;\">Costly to maintain and use.<\/td>\n<td style=\"width: 307px;\">Affordable because of the economy of scale.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 304px;\">Ideal for highly regulated industries (military, finance, etc.,)<\/td>\n<td style=\"width: 307px;\">Ideal for general use cases.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 304px;\">More control on the registry and its underlying infrastructure.<\/td>\n<td style=\"width: 307px;\">Less control on the registry and underlying infrastructure.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 304px;\">Provides enterprise features like LDAP authentication, image scanning, and signing.<\/td>\n<td style=\"width: 307px;\">Free cloud-based registries do not provide enterprise features however their paid alternatives do provide these features.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Let&#8217;s explore cloud-based registries first and then self-hosted registries.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Docker_Hub\"><\/span><b>Docker Hub<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Docker Hub is the world&#8217;s largest registry of publicly available container images. It is the default registry for the docker.<\/p>\n<p><span style=\"font-size: 15px;\">Apart from Docker hub, there are many well-established cloud registries out there, some of them are:<\/span><\/p>\n<ul>\n<li>Quay<\/li>\n<li>Google Container Registry<\/li>\n<li>Amazon Elastic Container Registry<\/li>\n<\/ul>\n<p><span style=\"font-size: 15px;\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-923 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-registry-services.png\" alt=\"\" width=\"794\" height=\"1123\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-registry-services.png 794w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-registry-services-212x300.png 212w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-registry-services-768x1086.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-registry-services-724x1024.png 724w\" sizes=\"(max-width: 794px) 100vw, 794px\" \/>As we mentioned before, the docker hub is the default registry for Docker. Whenever the docker daemon needs an image, it retrieves it from the Docker hub.<\/span><\/p>\n<p>You can search for docker images in the hub using the docker search command<\/p>\n<blockquote>\n<pre>$ docker search &lt;image-name&gt;<\/pre>\n<\/blockquote>\n<p>For this example, we are looking for an Nginx image. We can use the following command.<\/p>\n<blockquote>\n<pre>$ docker search nginx.<\/pre>\n<\/blockquote>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-926 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-search-nginx.png\" alt=\"\" width=\"964\" height=\"490\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-search-nginx.png 620w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-search-nginx-300x152.png 300w\" sizes=\"(max-width: 964px) 100vw, 964px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>As you can see there are multiple images available out there, let&#8217;s download the first nginx image using docker pull command.<\/p>\n<blockquote>\n<pre>$ docker pull &lt;image-name&gt;<\/pre>\n<\/blockquote>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-922 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-pull-ngnix.png\" alt=\"\" width=\"880\" height=\"212\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-pull-ngnix.png 639w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-pull-ngnix-300x72.png 300w\" sizes=\"(max-width: 880px) 100vw, 880px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>By default, the latest image will be pulled from the docker hub. We can check for the downloaded Nginx image using the docker images command.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-917 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-2.png\" alt=\"\" width=\"1610\" height=\"270\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-2.png 1610w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-2-300x50.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-2-768x129.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-2-1024x172.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-2-1080x181.png 1080w\" sizes=\"(max-width: 1610px) 100vw, 1610px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>Let&#8217;s run the nginx image using the following command.<\/p>\n<blockquote>\n<pre>$ docker run &lt;image-name&gt;<\/pre>\n<\/blockquote>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-912 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_run_nginx.png\" alt=\"\" width=\"875\" height=\"137\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_run_nginx.png 460w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker_run_nginx-300x47.png 300w\" sizes=\"(max-width: 875px) 100vw, 875px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>Open another terminal\/tab and type docker ps to see the list of the running containers in your machine.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-921 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-ps.png\" alt=\"\" width=\"870\" height=\"125\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-ps.png 647w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-ps-300x43.png 300w\" sizes=\"(max-width: 870px) 100vw, 870px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>Go back to the previous terminal\/tab and stop the running nginx container by using ctrl+c in the terminal. We can check the status of the running containers be re-running the docker ps command. You will see that the previous nginx container is no longer running.<\/p>\n<p>Once we are done using nginx image, we can remove the image from the local machine using docker rmi command<\/p>\n<blockquote>\n<pre>$ docker rmi &lt;image-name&gt; - -force<\/pre>\n<\/blockquote>\n<p>&#8212; force tag is used to remove image forcefully<\/p>\n<blockquote><p><span style=\"color: #e02b20;\"><strong>If you are our paid customer and taking any of our courses like CDE\/CDP\/CCSE\/CCNSE, please use the browser based lab portal to do all the exercises and do not use the below Virtual Machine.<\/strong>\u00a0<\/span><\/p>\n<h2><\/h2>\n<\/blockquote>\n<h2><\/h2>\n<h2><span class=\"ez-toc-section\" id=\"Task-2\"><\/span><b>Task<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><b><span style=\"font-weight: 300;\">Remove the Nginx image and run the Nginx container again without pulling it from the repository.<\/span><\/b><\/p>\n<h2><span class=\"ez-toc-section\" id=\"Self-hosted_Docker_registry\"><\/span><b>Self-hosted Docker registry<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>As we discussed before, we can host our own local registry. We will use docker to setup the Docker registry \ud83d\ude42<\/p>\n<p>Open up a terminal and run the following command.<\/p>\n<blockquote>\n<pre>$ docker run -d -p 5000:5000 --restart=always --name registry registry:2<\/pre>\n<\/blockquote>\n<p>We are using the registry image provided by docker to host our local docker registry.\u00a0 Please ignore the new command options, for now. We will cover these options in the next lesson.<\/p>\n<p><strong>&#8211;restart<\/strong> = Unless stopped manually, please restart the container if it dies for some reason.<\/p>\n<p><strong>-d<\/strong> = detached mode, run the container in the background.<\/p>\n<p><strong>-p<\/strong> = port mapping, host_port:container_port, expose port 5000 of registry on localhost:5000<\/p>\n<p><strong>-name<\/strong> = custom name<\/p>\n<p>We created the mynmap container in the last exercises, let&#8217;s tag it as version 1.0 and upload it to the local registry.<\/p>\n<blockquote>\n<pre>$docker tag mynmap:latest localhost:5000\/mynmap:1.0<\/pre>\n<\/blockquote>\n<p>Upload the container to our repository using the below push command<\/p>\n<blockquote>\n<pre>$ docker push localhost:5000\/mynmap:1.0<\/pre>\n<\/blockquote>\n<p>Now remove the locally available container by typing the below command in the terminal<\/p>\n<blockquote>\n<pre>$ docker rmi localhost:5000\/mynmap:1.0<\/pre>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>$ docker rmi mynmap:latest -f<\/p><\/blockquote>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-924 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-rm-nmap.png\" alt=\"\" width=\"1344\" height=\"250\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-rm-nmap.png 1344w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-rm-nmap-300x56.png 300w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-rm-nmap-768x143.png 768w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-rm-nmap-1024x190.png 1024w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-rm-nmap-1080x201.png 1080w\" sizes=\"(max-width: 1344px) 100vw, 1344px\" \/><\/p>\n<p>Type the below command to pull the image from the local docker registry.<\/p>\n<blockquote>\n<pre>$ docker pull localhost:5000\/mynmap:1.0<\/pre>\n<\/blockquote>\n<p>We can use this newly downloaded mynmap image as usual.<\/p>\n<blockquote>\n<pre>$ docker run localhost:5000\/mynmap:1.0 localhost<\/pre>\n<\/blockquote>\n<h2><span class=\"ez-toc-section\" id=\"Task-3\"><\/span><b>Task<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Create a new docker image using a Dockerfile with Nginx and run it on port 80. Once you have created the image,\u00a0 push it to the local registry.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Reference\"><\/span><b>Reference<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><strong>Lesson 1<\/strong>, Understand Docker from a security perspective &#8211; <a href=\"https:\/\/www.devsecops.ltd\/lesson-1-understand-docker-from-a-security-perspective\/\">https:\/\/www.devsecops.ltd\/lesson-1-understand-docker-from-a-security-perspective\/<\/a><\/p>\n<h2><span class=\"ez-toc-section\" id=\"Conclusion\"><\/span><b>Conclusion<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>You deserve a pat on your back for reading up to here. We have covered a lot of ground today especially Docker images, Docker Image layers, and Docker Registries. With this strong foundation, you can perform vulnerability assessments on the docker images.<\/p>\n<p>In the next lesson, we will be learning about docker containers, docker networking, and docker volumes. You will also see how to manage multiple containers using docker-compose.<\/p>\n<p><strong>P.S.<\/strong> Remember to <a href=\"https:\/\/www.devsecops.ltd\/lesson-2-docker-images-docker-layers-and-registry\/\">comment here<\/a> if you have any questions or comments.<\/p>\n<h1><\/h1>\n<h2><span class=\"ez-toc-section\" id=\"Appendix_A\"><\/span><b>Appendix A<\/b><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><b>Another way to create a docker image.<\/b><\/p>\n<p>The idea behind this technique is to create a new container with the desired base image and then run commands to set it up. Once you are satisfied with the container behavior, you export this container into an image.<\/p>\n<p>For this example, we will be using an alpine image, install git in it and then create a new image out of it.<\/p>\n<p><strong>Step 1:<\/strong> run an alpine container and access the shell.<\/p>\n<blockquote>\n<pre>$ docker run -it alpine sh<\/pre>\n<\/blockquote>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-925 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-run-alpine-sh.png\" alt=\"\" width=\"868\" height=\"196\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-run-alpine-sh.png 567w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-run-alpine-sh-300x68.png 300w\" sizes=\"(max-width: 868px) 100vw, 868px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-size: 15px;\"><strong>Step 2:<\/strong> Install git using the below command<\/span><\/p>\n<blockquote>\n<pre>$ apk add git<\/pre>\n<\/blockquote>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-909 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/apk-add-git.png\" alt=\"\" width=\"870\" height=\"295\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/apk-add-git.png 646w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/apk-add-git-300x102.png 300w\" sizes=\"(max-width: 870px) 100vw, 870px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>Exit out of the container by typing exit in the container shell.<\/p>\n<p><strong>Step 3:<\/strong> Commit the new changes made on the container layer(write layer) to create a new image.<\/p>\n<blockquote>\n<pre>$ docker commit &lt;container-id&gt; &lt;name&gt;<\/pre>\n<\/blockquote>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-915 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-commit-alpine.png\" alt=\"\" width=\"854\" height=\"56\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-commit-alpine.png 595w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-commit-alpine-300x20.png 300w\" sizes=\"(max-width: 854px) 100vw, 854px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>You can verify the creation of a new image by using docker images command.<\/p>\n<blockquote>\n<pre>$ docker images<\/pre>\n<\/blockquote>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-920 aligncenter size-full\" src=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images.png\" alt=\"\" width=\"871\" height=\"223\" srcset=\"https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images.png 613w, https:\/\/www.devsecops.ltd\/wp-content\/uploads\/2019\/10\/docker-images-300x77.png 300w\" sizes=\"(max-width: 871px) 100vw, 871px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>We have successfully created the docker image using ad-hoc commands. This definitely helps in creating a one-off image for debugging purposes but is not a recommended practice.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>PRACTICAL DEVSECOP&#8217;S DOCKER IMAGE DEEP DIVE<\/p>\n","protected":false},"author":2,"featured_media":2028,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"off","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[16],"tags":[],"_links":{"self":[{"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/posts\/889"}],"collection":[{"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/comments?post=889"}],"version-history":[{"count":2,"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/posts\/889\/revisions"}],"predecessor-version":[{"id":242808,"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/posts\/889\/revisions\/242808"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/media\/2028"}],"wp:attachment":[{"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/media?parent=889"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/categories?post=889"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devsecops.ltd\/wp-json\/wp\/v2\/tags?post=889"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}