Docker#
Docker containers, images, networks, and volumes from the operator’s seat. The same primitives let blue teams ship reproducible defended hosts and red teams pivot through misconfigured engines.
Container basics#
$ docker run -p 4000:80 imgname # start container
$ docker run -d -p 4000:80 imgname # detached
$ docker run -t -d --entrypoint=/bin/sh "$docker_image" # start with entrypoint
$ docker exec -it <container-id> sh # enter a running container
$ docker cp /tmp/foo.txt mycontainer:/foo.txt # upload file
$ docker cp mycontainer:/foo.txt /tmp/foo.txt # download file
$ docker stop <hash> # stop container
$ docker rm <hash> # remove container
$ docker rm $(docker ps -a -q) # remove all containers
$ docker kill <hash> # force shutdown
$ docker login # login to docker hub
$ docker tag <image> username/repo:tag
$ docker push username/repo:tag
$ docker run username/repo:tag
$ docker build -t denny/image:test . # build image
Cleanup#
delete-all-containers.sh # delete all containers
delete-unused-images.sh # delete unused images
$ docker image prune -f
$ docker volume prune -f
$ docker rmi <imagename> # remove specified image
$ docker rmi $(docker images -q) # remove all images
$ docker volume rm $(docker volume ls -qf dangling=true) # orphaned volumes
$ docker rm $(docker ps --filter status=dead -qa) # dead containers
$ docker rm $(docker ps --filter status=exited -qa) # exited containers
Dockerfile#
entrypoint: ["tail", "-f", "/dev/null"] # change entrypoint to no-op
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
Docker Compose#
$ docker-compose up # start
$ docker-compose up -d # detached
$ docker-compose down # stop
$ docker-compose down -v
$ docker-compose logs
Images#
$ docker images # list images
$ docker images -a # list all (including intermediate)
$ docker build -t denny/image:tag . # create image
$ docker push denny/image:<tag> # push image
$ docker history <image_name> # image history
$ docker save <image_name> > my_img.tar # export
$ docker load -i my_img.tar # load to local registry
$ docker tag <image> username/repo:tag
Socket files#
$ docker run -v /var/run/docker.sock:/var/run/docker.sock -it alpine sh
$ export DOCKER_HOST=unix:///my/docker.sock
$ curl -XGET --unix-socket /var/run/docker.sock http://localhost/containers/json
$ curl -XPOST --unix-socket /var/run/docker.sock http://localhost/containers/<id>/stop
$ curl -XPOST --unix-socket /var/run/docker.sock http://localhost/containers/<id>/start
$ curl --unix-socket /var/run/docker.sock http://localhost/events
$ curl -XPOST --unix-socket /var/run/docker.sock \
-d '{"Image":"nginx:alpine"}' -H 'Content-Type: application/json' \
http://localhost/containers/create
Conf#
/var/lib/docker, /var/lib/docker/devicemapper/mnt # Docker files
~/Library/Containers/com.docker.docker/Data # Docker for Mac
Status#
$ docker logs --tail 5 $container_name # tail container logs
$ docker inspect --format '{{.State.Health}}' $container_name
$ docker ps # list containers
$ docker ps -a # list all containers
$ docker ps --filter "label=org.label-schema.group" # list by labels
$ docker images -a