Docker/Dockerhub

Docker Hub

To use docker hub, visit https://hub.docker.com/

httpd repository: https://hub.docker.com/_/httpd/

Docker pull

The docker pull command will basically fetch the latest version of a particular docker image, without any modifications. (The alternative is to customize the image by creating a Dockerfile based on the Dockerfile contained on Docker hub.)

$ docker pull httpd
latest: Pulling from httpd
c1f98057d627: Pull complete
c35ece8820ad: Pull complete
eeeee05b2d97: Pull complete
b356f7d0a4b0: Pull complete
cff60f000364: Pull complete
f66e93df25da: Pull complete
5aa754215a2b: Pull complete
ed544656f0fa: Pull complete
ffafc39cb69f: Pull complete
4c5d8313f629: Pull complete
55a6feaaae56: Pull complete
c1aa308548aa: Pull complete
919bf0916a6a: Pull complete
eb58b1ce0fcd: Pull complete
ce15017ba45e: Pull complete
617bdb3e78f6: Pull complete
738ba280808d: Pull complete
017d0384902a: Pull complete
d61c615e53ce: Pull complete
Digest: sha256:a5b5747c921fdac4e53197d2624ddad22fa9a13dfe31b305273be5149882c3e9
Status: Downloaded newer image for httpd:latest

Can also pull other docker containers. Here is a shorter list of dependencies/layers:

$ docker pull debian

latest: Pulling from debian
0aa3f9bb64ef: Pull complete
c1f98057d627: Already exists
Digest: sha256:fa8fd9718d2697730acc9a374dc2e1d54719177f474abbc8d5f74ebad5cb8a30
Status: Downloaded newer image for debian:latest

Docker images

To see the docker container images that are installed, use the docker images command:

$ docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             VIRTUAL SIZE
httpd               latest              d61c615e53ce        2 days ago          176.9 MB
debian              latest              0aa3f9bb64ef        2 days ago          123.4 MB
hello-world         latest              7a5a2d73abce        9 weeks ago         1.84 kB

Running docker images

If you want to run one of the images, use the docker run command. Give the container a name, and tell it what image to use.

$ docker run --name test -it debian

This also connects a TTY console to the container, so you have a basic bash shell on the virtual machine that runs the container.

Docker Internals

One of the interesting things you can do is run Docker using the privileged flag, which basically gives Docker the same rights as root or as the user who ran Docker:

The --privileged flag gives all capabilities to the container, and it also lifts all the limitations enforced by the device cgroup controller. In other words, the container can then do almost everything that the host can do. This flag exists to allow special use-cases, like running Docker within Docker.

Use the Docker command line

$ docker run -t -i --privileged ubuntu bash

Docker command line: https://docs.docker.com/engine/reference/commandline/cli/

Security Notes

Being in the docker group gives you serious root-level powers. Info about attack surface of Docker: https://docs.docker.com/engine/security/security/#docker-daemon-attack-surface

Note that, as mentioned above, the --privileged flag allows Docker the same privileges as the user who ran the command.