Compare commits

...

29 Commits

Author SHA1 Message Date
Adolfo Delorenzo c9337417ae Dockerfile 2021-09-07 17:11:20 -06:00
Stefan Scherer 13386236e4
Merge pull request #134 from docker/dependabot/pip/pygments-2.7.4
Bump pygments from 2.6.1 to 2.7.4
2021-05-06 07:34:25 +02:00
Stefan Scherer 2376af82e7
Merge pull request #135 from docker/dependabot/npm_and_yarn/app/y18n-4.0.1
Bump y18n from 4.0.0 to 4.0.1 in /app
2021-05-06 07:30:51 +02:00
dependabot[bot] e991a5ab73
Bump y18n from 4.0.0 to 4.0.1 in /app
Bumps [y18n](https://github.com/yargs/y18n) from 4.0.0 to 4.0.1.
- [Release notes](https://github.com/yargs/y18n/releases)
- [Changelog](https://github.com/yargs/y18n/blob/master/CHANGELOG.md)
- [Commits](https://github.com/yargs/y18n/commits)

Signed-off-by: dependabot[bot] <support@github.com>
2021-03-31 15:30:29 +00:00
dependabot[bot] 62e2117581
Bump pygments from 2.6.1 to 2.7.4
Bumps [pygments](https://github.com/pygments/pygments) from 2.6.1 to 2.7.4.
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](https://github.com/pygments/pygments/compare/2.6.1...2.7.4)

Signed-off-by: dependabot[bot] <support@github.com>
2021-03-29 22:08:19 +00:00
Alex White 4b6b5476c5 Update README.md 2021-03-09 08:50:32 +00:00
zipperer e43a605d37 Edit docs/tutorial/using-bind-mounts/index.md
'uses cases' |-> 'use cases'
2021-03-09 08:49:09 +00:00
Stefan Scherer eccb882c59 Add build tools to fix arm64 build issue
Signed-off-by: Stefan Scherer <stefan.scherer@docker.com>
2021-03-09 08:47:47 +00:00
Stefan Scherer 3de6451f5c
Merge pull request #104 from StefanScherer/build-arm64
Build amd64 and arm64 image
2020-12-10 19:42:46 +01:00
Stefan Scherer b66f1c3224
Build amd64 and arm64 image
Signed-off-by: Stefan Scherer <stefan.scherer@docker.com>
2020-12-10 12:34:01 +01:00
Stephen Turner 23e02b9a44
Add section on vulnerability scanning (#98)
* Update index.md

* Add files via upload

* Update index.md

* Update docs/tutorial/image-building-best-practices/index.md

Co-authored-by: Usha Mandya <47779042+usha-mandya@users.noreply.github.com>

* Update index.md

Co-authored-by: Usha Mandya <47779042+usha-mandya@users.noreply.github.com>
2020-11-02 12:24:36 +00:00
dependabot[bot] 5cccd65849 Bump yargs-parser from 13.1.1 to 13.1.2 in /app
Bumps [yargs-parser](https://github.com/yargs/yargs-parser) from 13.1.1 to 13.1.2.
- [Release notes](https://github.com/yargs/yargs-parser/releases)
- [Changelog](https://github.com/yargs/yargs-parser/blob/master/docs/CHANGELOG-full.md)
- [Commits](https://github.com/yargs/yargs-parser/commits)

Signed-off-by: dependabot[bot] <support@github.com>
2020-10-22 14:54:02 +01:00
Tony Brown 9646231353 Update multi-container-apps env vars security typo 2020-10-22 09:07:54 +01:00
Tim Gibson 3cbe2e686e Update README.md 2020-10-22 09:04:31 +01:00
Stefan Scherer 172c616131
Merge pull request #81 from mat007/build-github-action
Add github action to build
2020-09-30 16:35:34 +02:00
Stefan Scherer 6190776cb6
Merge pull request #77 from Fl4zher/fix-typo
fixing typo
2020-08-31 07:21:30 +02:00
Mathieu Champlon 3323acf03e Add github action to build
This makes sure the project builds correctly.
2020-08-27 11:01:06 +02:00
Stefan Scherer 559d5f335e
Merge pull request #73 from veyndan/patch-1
Fix typo
2020-08-25 12:16:01 +02:00
Stefan Scherer 6916e6a595
Merge pull request #78 from coreygarvey/patch-1
Update docs w/ missing "to"
2020-08-25 12:14:38 +02:00
Corey Garvey bb961ef28d
Update docs w/ missing "to"
Missing word in the docs
2020-08-15 11:15:52 +01:00
Harun Kilic 0b402b3ebf
fixing typo 2020-08-07 02:09:28 +02:00
Veyndan Stuart 4ed7232ea2
Fix typo 2020-08-01 20:45:52 +02:00
Stefan Scherer 9f31a47053
Merge pull request #72 from docker/dependabot/npm_and_yarn/app/lodash-4.17.19
Bump lodash from 4.17.15 to 4.17.19 in /app
2020-07-20 20:04:57 +02:00
dependabot[bot] b1d106ea7c
Bump lodash from 4.17.15 to 4.17.19 in /app
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.15 to 4.17.19.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.15...4.17.19)

Signed-off-by: dependabot[bot] <support@github.com>
2020-07-19 17:31:36 +00:00
Stefan Scherer 288a57ea63
Merge pull request #71 from StefanScherer/fix-jenkinsfile
Fix build command
2020-07-15 09:00:05 +02:00
Stefan Scherer f232e36815
Fix build command
Signed-off-by: Stefan Scherer <stefan.scherer@docker.com>
2020-07-15 08:59:02 +02:00
Stefan Scherer fe2686fe00
Merge pull request #70 from StefanScherer/powershell
Show multiline PowerShell commands
2020-07-15 08:55:44 +02:00
Stefan Scherer a33ed89ab3
Quote volume mapping and use pwd
Signed-off-by: Stefan Scherer <stefan.scherer@docker.com>
2020-07-15 08:45:25 +02:00
Stefan Scherer f77065be98
Show multiline PowerShell commands
Signed-off-by: Stefan Scherer <stefan.scherer@docker.com>
2020-07-15 08:20:44 +02:00
16 changed files with 157 additions and 33 deletions

12
.github/workflows/build.yml vendored Normal file
View File

@ -0,0 +1,12 @@
name: Build
on: [push, pull_request]
jobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: Build
uses: docker/build-push-action@v1
with:
push: false

View File

@ -7,6 +7,7 @@ RUN pip install -r requirements.txt
# Run tests to validate app
FROM node:12-alpine AS app-base
RUN apk add --no-cache python g++ make
WORKDIR /app
COPY app/package.json app/yarn.lock ./
RUN yarn install

4
Jenkinsfile vendored
View File

@ -10,7 +10,7 @@ pipeline {
when {
branch 'master'
}
sh "docker build docker/getting-started ."
sh "docker build -t docker/getting-started ."
steps {
withDockerRegistry([url: "", credentialsId: "dockerbuildbot-index.docker.io"]) {
@ -19,4 +19,4 @@ pipeline {
}
}
}
}
}

View File

@ -37,6 +37,6 @@ docker-compose up
If you find typos or other issues with the tutorial, feel free to create a PR and suggest fixes!
If you have ideas on how to make the tutorial better or new content, please open an issue first before working on your idea. While we love input, we want to keep the tutorial is scoped to new-comers.
If you have ideas on how to make the tutorial better or new content, please open an issue first before working on your idea. While we love input, we want to keep the tutorial scoped to newcomers.
As such, we may reject ideas for more advanced requests and don't want you to lose any work you might
have done. So, ask first and we'll gladly hear your thoughts!

7
app/Dockerfile Normal file
View File

@ -0,0 +1,7 @@
# syntax=docker/dockerfile:1
FROM node:12-alpine
RUN apk add --no-cache python g++ make
WORKDIR /app
COPY . .
RUN yarn install --production
CMD ["node", "src/index.js"]

View File

@ -8,9 +8,10 @@
<link rel="stylesheet" href="css/font-awesome/all.min.css" crossorigin="anonymous" />
<link href="https://fonts.googleapis.com/css?family=Lato&display=swap" rel="stylesheet" />
<link rel="stylesheet" href="css/styles.css" />
<title>Todo App</title>
<title>Lista de compras</title>
</head>
<body>
<center><h2>Lista de Compras</h2></center>
<div id="root"></div>
<script src="js/react.production.min.js"></script>
<script src="js/react-dom.production.min.js"></script>

View File

@ -53,7 +53,7 @@ function TodoListCard() {
<React.Fragment>
<AddItemForm onNewItem={onNewItem} />
{items.length === 0 && (
<p className="text-center">No items yet! Add one above!</p>
<p className="text-center">Adicionar um item</p>
)}
{items.map(item => (
<ItemDisplay
@ -96,7 +96,7 @@ function AddItemForm({ onNewItem }) {
value={newItem}
onChange={e => setNewItem(e.target.value)}
type="text"
placeholder="New Item"
placeholder="Novo produto"
aria-describedby="basic-addon1"
/>
<InputGroup.Append>
@ -106,7 +106,7 @@ function AddItemForm({ onNewItem }) {
disabled={!newItem.length}
className={submitting ? 'disabled' : ''}
>
{submitting ? 'Adding...' : 'Add Item'}
{submitting ? 'Adding...' : 'OK'}
</Button>
</InputGroup.Append>
</InputGroup>

View File

@ -2592,9 +2592,9 @@ lodash.sortby@^4.7.0:
integrity sha1-7dFMgk4sycHgsKG0K7UhBRakJDg=
lodash@^4.17.11, lodash@^4.17.13:
version "4.17.15"
resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.15.tgz#b447f6670a0455bbfeedd11392eff330ea097548"
integrity sha512-8xOcRHvCjnocdS5cpwXQXVzmmh5e5+saE2QGoeQmbKmRS6J3VQppPOIt0MnmE+4xlZoumy0GPG0D0MVIQbNA1A==
version "4.17.19"
resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.19.tgz#e48ddedbe30b3321783c5b4301fbd353bc1e4a4b"
integrity sha512-JNvd8XER9GQX0v2qJgsaN/mzFCNA5BRe/j8JN9d+tWyGLSodKQHKFicdwNYzWwI3wjRnaKPsGj1XkBjx/F96DQ==
loose-envify@^1.0.0:
version "1.4.0"
@ -4366,9 +4366,9 @@ xml-name-validator@^3.0.0:
integrity sha512-A5CUptxDsvxKJEU3yO6DuWBSJz/qizqzJKOMIfUJHETbBw/sFaDxgd6fxm1ewUaM0jZ444Fc5vC5ROYurg/4Pw==
y18n@^4.0.0:
version "4.0.0"
resolved "https://registry.yarnpkg.com/y18n/-/y18n-4.0.0.tgz#95ef94f85ecc81d007c264e190a120f0a3c8566b"
integrity sha512-r9S/ZyXu/Xu9q1tYlpsLIsa3EeLXXk0VwlxqTcFRfg9EhMW+17kbt9G0NrgCmhGb5vT2hyhJZLfDGx+7+5Uj/w==
version "4.0.1"
resolved "https://registry.yarnpkg.com/y18n/-/y18n-4.0.1.tgz#8db2b83c31c5d75099bb890b23f3094891e247d4"
integrity sha512-wNcy4NvjMYL8gogWWYAO7ZFWFfHcbdbE57tZO8e4cbpj8tfUcwrwqSl3ad8HxpYWCdXcJUCeKKZS62Av1affwQ==
yallist@^2.1.2:
version "2.1.2"
@ -4381,9 +4381,9 @@ yallist@^3.0.0, yallist@^3.0.3:
integrity sha512-S+Zk8DEWE6oKpV+vI3qWkaK+jSbIK86pCwe2IF/xwIpQ8jEuxpw9NyaGjmp9+BoJv5FV2piqCDcoCtStppiq2A==
yargs-parser@^13.1.1:
version "13.1.1"
resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-13.1.1.tgz#d26058532aa06d365fe091f6a1fc06b2f7e5eca0"
integrity sha512-oVAVsHz6uFrg3XQheFII8ESO2ssAf9luWuAd6Wexsu4F3OtIW0o8IribPXYrD4WC24LWtPrJlGy87y5udK+dxQ==
version "13.1.2"
resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-13.1.2.tgz#130f09702ebaeef2650d54ce6e3e5706f7a4fb38"
integrity sha512-3lbsNRf/j+A4QuSZfDRA7HRSfWrzO0YjqTJd5kjAq37Zep1CEgaYmrH9Q3GwPiB9cHyd1Y1UwggGhJGoxipbzg==
dependencies:
camelcase "^5.0.0"
decamelize "^1.2.0"

View File

@ -9,6 +9,6 @@ else
fi
docker buildx build \
--platform linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6 \
--platform linux/amd64,linux/arm64 \
-t docker/getting-started:latest \
$( (( $WILL_PUSH == 1 )) && printf %s '--push' ) .

Binary file not shown.

After

Width:  |  Height:  |  Size: 125 KiB

View File

@ -1,3 +1,46 @@
## Security Scanning
When you have built an image, it is good practice to scan it for security vulnerabilities using the `docker scan` command.
Docker has partnered with [Snyk](http://snyk.io) to provide the vulnerability scanning service.
For example, to scan the `getting-started` image you created earlier in the tutorial, you can just type
```bash
docker scan getting-started
```
The scan uses a constantly updated database of vulnerabilities, so the output you see will vary as new
vulnerabilities are discovered, but it might look something like this:
```plaintext
✗ Low severity vulnerability found in freetype/freetype
Description: CVE-2020-15999
Info: https://snyk.io/vuln/SNYK-ALPINE310-FREETYPE-1019641
Introduced through: freetype/freetype@2.10.0-r0, gd/libgd@2.2.5-r2
From: freetype/freetype@2.10.0-r0
From: gd/libgd@2.2.5-r2 > freetype/freetype@2.10.0-r0
Fixed in: 2.10.0-r1
✗ Medium severity vulnerability found in libxml2/libxml2
Description: Out-of-bounds Read
Info: https://snyk.io/vuln/SNYK-ALPINE310-LIBXML2-674791
Introduced through: libxml2/libxml2@2.9.9-r3, libxslt/libxslt@1.1.33-r3, nginx-module-xslt/nginx-module-xslt@1.17.9-r1
From: libxml2/libxml2@2.9.9-r3
From: libxslt/libxslt@1.1.33-r3 > libxml2/libxml2@2.9.9-r3
From: nginx-module-xslt/nginx-module-xslt@1.17.9-r1 > libxml2/libxml2@2.9.9-r3
Fixed in: 2.9.9-r4
```
The output lists the type of vulnerability, a URL to learn more, and importantly which version of the relevant library
fixes the vulnerability.
There are several other options, which you can read about in the [docker scan documentation](https://docs.docker.com/engine/scan/).
As well as scanning your newly built image on the command line, you can also [configure Docker Hub](https://docs.docker.com/docker-hub/vulnerability-scanning/)
to scan all newly pushed images automatically, and you can then see the results in both Docker Hub and Docker Desktop.
![Hub vulnerability scanning](hvs.png){: style=width:75% }
{: .text-center }
## Image Layering
@ -222,6 +265,6 @@ into an nginx container. Cool, huh?
## Recap
By understanding a little bit about how images are structured, we can build images faster and ship fewer changes.
Scanning images gives us confidence that the containers we are running and distributing are secure.
Multi-stage builds also help us reduce overall image size and increase final container security by separating
build-time dependencies from runtime dependencies.

View File

@ -37,8 +37,8 @@ For now, we will create the network first and attach the MySQL container at star
docker network create todo-app
```
1. Start a MySQL container and attach it the network. We're also going to define a few environment variables that the
database will use to initialize the database (see the "Environment Variables" section in the [MySQL Docker Hub listing](https://hub.docker.com/_/mysql/)) (replace the ` \ ` characters with `` ` `` in Windows PowerShell).
1. Start a MySQL container and attach it to the network. We're also going to define a few environment variables that the
database will use to initialize the database (see the "Environment Variables" section in the [MySQL Docker Hub listing](https://hub.docker.com/_/mysql/)).
```bash
docker run -d \
@ -49,6 +49,17 @@ For now, we will create the network first and attach the MySQL container at star
mysql:5.7
```
If you are using PowerShell then use this command.
```powershell
docker run -d `
--network todo-app --network-alias mysql `
-v todo-mysql-data:/var/lib/mysql `
-e MYSQL_ROOT_PASSWORD=secret `
-e MYSQL_DATABASE=todos `
mysql:5.7
```
You'll also see we specified the `--network-alias` flag. We'll come back to that in just a moment.
!!! info "Pro-tip"
@ -156,7 +167,7 @@ The todo app supports the setting of a few environment variables to specify MySQ
A more secure mechanism is to use the secret support provided by your container orchestration framework. In most cases,
these secrets are mounted as files in the running container. You'll see many apps (including the MySQL image and the todo app)
also support env vars with a `_FILE` suffix to point to a file containing the file.
also support env vars with a `_FILE` suffix to point to a file containing the variable.
As an example, setting the `MYSQL_PASSWORD_FILE` var will cause the app to use the contents of the referenced file
as the connection password. Docker doesn't do anything to support these env vars. Your app will need to know to look for
@ -165,11 +176,11 @@ The todo app supports the setting of a few environment variables to specify MySQ
With all of that explained, let's start our dev-ready container!
1. We'll specify each of the environment variables above, as well as connect the container to our app network (replace the ` \ ` characters with `` ` `` in Windows PowerShell).
1. We'll specify each of the environment variables above, as well as connect the container to our app network.
```bash hl_lines="3 4 5 6 7"
docker run -dp 3000:3000 \
-w /app -v ${PWD}:/app \
-w /app -v "$(pwd):/app" \
--network todo-app \
-e MYSQL_HOST=mysql \
-e MYSQL_USER=root \
@ -179,6 +190,20 @@ With all of that explained, let's start our dev-ready container!
sh -c "yarn install && yarn run dev"
```
If you are using PowerShell then use this command.
```powershell hl_lines="3 4 5 6 7"
docker run -dp 3000:3000 `
-w /app -v "$(pwd):/app" `
--network todo-app `
-e MYSQL_HOST=mysql `
-e MYSQL_USER=root `
-e MYSQL_PASSWORD=secret `
-e MYSQL_DB=todos `
node:12-alpine `
sh -c "yarn install && yarn run dev"
```
1. If we look at the logs for the container (`docker logs <container-id>`), we should see a message indicating it's
using the mysql database.
@ -199,7 +224,7 @@ With all of that explained, let's start our dev-ready container!
is **secret**.
```bash
docker exec -ti <mysql-container-id> mysql -p todos
docker exec -it <mysql-container-id> mysql -p todos
```
And in the mysql shell, run the following:

View File

@ -38,6 +38,7 @@ see a few flaws in the Dockerfile below. But, don't worry! We'll go over them.
```dockerfile
FROM node:12-alpine
RUN apk add --no-cache python g++ make
WORKDIR /app
COPY . .
RUN yarn install --production

View File

@ -14,7 +14,7 @@ changes and then restart the application. There are equivalent tools in most oth
## Quick Volume Type Comparisons
Bind mounts and named volumes are the two main types of volumes that come with the Docker engine. However, additional
volume drivers are available to support other uses cases ([SFTP](https://github.com/vieux/docker-volume-sshfs), [Ceph](https://ceph.com/geen-categorie/getting-started-with-the-docker-rbd-volume-plugin/), [NetApp](https://netappdvp.readthedocs.io/en/stable/), [S3](https://github.com/elementar/docker-s3-volume), and more).
volume drivers are available to support other use cases ([SFTP](https://github.com/vieux/docker-volume-sshfs), [Ceph](https://ceph.com/geen-categorie/getting-started-with-the-docker-rbd-volume-plugin/), [NetApp](https://netappdvp.readthedocs.io/en/stable/), [S3](https://github.com/elementar/docker-s3-volume), and more).
| | Named Volumes | Bind Mounts |
| - | ------------- | ----------- |
@ -36,18 +36,27 @@ So, let's do it!
1. Make sure you don't have any previous `getting-started` containers running.
1. Run the following command (replace the ` \ ` characters with `` ` `` in Windows PowerShell). We'll explain what's going on afterwards:
1. Run the following command. We'll explain what's going on afterwards:
```bash
docker run -dp 3000:3000 \
-w /app -v ${PWD}:/app \
-w /app -v "$(pwd):/app" \
node:12-alpine \
sh -c "yarn install && yarn run dev"
```
If you are using PowerShell then use this command.
```powershell
docker run -dp 3000:3000 `
-w /app -v "$(pwd):/app" `
node:12-alpine `
sh -c "yarn install && yarn run dev"
```
- `-dp 3000:3000` - same as before. Run in detached (background) mode and create a port mapping
- `-w /app` - sets the "working directory" or the current directory that the command will run from
- `-v ${PWD}:/app` - bind mount the current directory from the host in the container into the `/app` directory
- `-v "$(pwd):/app"` - bind mount the current directory from the host in the container into the `/app` directory
- `node:12-alpine` - the image to use. Note that this is the base image for our app from the Dockerfile
- `sh -c "yarn install && yarn run dev"` - the command. We're starting a shell using `sh` (alpine doesn't have `bash`) and
running `yarn install` to install _all_ dependencies and then running `yarn run dev`. If we look in the `package.json`,

View File

@ -49,11 +49,11 @@ And now, we'll start migrating a service at a time into the compose file.
## Defining the App Service
To remember, this was the command we were using to define our app container (replace the ` \ ` characters with `` ` `` in Windows PowerShell).
To remember, this was the command we were using to define our app container.
```bash
docker run -dp 3000:3000 \
-w /app -v ${PWD}:/app \
-w /app -v "$(pwd):/app" \
--network todo-app \
-e MYSQL_HOST=mysql \
-e MYSQL_USER=root \
@ -63,6 +63,20 @@ docker run -dp 3000:3000 \
sh -c "yarn install && yarn run dev"
```
If you are using PowerShell then use this command.
```powershell
docker run -dp 3000:3000 `
-w /app -v "$(pwd):/app" `
--network todo-app `
-e MYSQL_HOST=mysql `
-e MYSQL_USER=root `
-e MYSQL_PASSWORD=secret `
-e MYSQL_DB=todos `
node:12-alpine `
sh -c "yarn install && yarn run dev"
```
1. First, let's define the service entry and the image for the container. We can pick any name for the service.
The name will automatically become a network alias, which will be useful when defining our MySQL service.
@ -102,7 +116,7 @@ docker run -dp 3000:3000 \
- 3000:3000
```
1. Next, we'll migrate both the working directory (`-w /app`) and the volume mapping (`-v ${PWD}:/app`) by using
1. Next, we'll migrate both the working directory (`-w /app`) and the volume mapping (`-v "$(pwd):/app"`) by using
the `working_dir` and `volumes` definitions. Volumes also has a [short](https://docs.docker.com/compose/compose-file/#short-syntax-3) and [long](https://docs.docker.com/compose/compose-file/#long-syntax-3) syntax.
One advantage of Docker Compose volume definitions is we can use relative paths from the current directory.
@ -145,7 +159,7 @@ docker run -dp 3000:3000 \
### Defining the MySQL Service
Now, it's time to define the MySQL service. The command that we used for that container was the following (replace the ` \ ` characters with `` ` `` in Windows PowerShell):
Now, it's time to define the MySQL service. The command that we used for that container was the following:
```bash
docker run -d \
@ -156,6 +170,17 @@ docker run -d \
mysql:5.7
```
If you are using PowerShell then use this command.
```powershell
docker run -d `
--network todo-app --network-alias mysql `
-v todo-mysql-data:/var/lib/mysql `
-e MYSQL_ROOT_PASSWORD=secret `
-e MYSQL_DATABASE=todos `
mysql:5.7
```
1. We will first define the new service and name it `mysql` so it automatically gets the network alias. We'll
go ahead and specify the image to use as well.

View File

@ -1,5 +1,5 @@
mkdocs==1.0.4
mkdocs-material==4.6.3
mkdocs-minify-plugin==0.2.3
pygments==2.6.1
pygments==2.7.4
pymdown-extensions==7.0