Docker Containerization for System Administrators

This comprehensive guide covers Docker fundamentals, best practices, and production deployment strategies for system administrators managing containerized applications.

Why Docker? Containers provide consistency across environments, faster deployment, and better resource utilization compared to traditional VMs.

Understanding Containers

What are Containers?

Containers are lightweight, portable units that package applications with all their dependencies. Unlike virtual machines, containers share the host OS kernel, making them:

• More efficient in resource usage
• Faster to start (seconds vs minutes)
• Easier to version and distribute
• Ideal for microservices architecture

Containers vs Virtual Machines

Docker Fundamentals

Installation

Install Docker on Ubuntu/Debian:

# Download installation script
curl -fsSL https://get.docker.com -o get-docker.sh

# Run installation
sh get-docker.sh

# Add user to docker group (optional)
sudo usermod -aG docker $USER

# Verify installation
docker --version

Essential Commands

Here are the most commonly used Docker commands:

# Image operations
docker pull nginx:latest          # Download image
docker images                     # List local images
docker rmi nginx:latest          # Remove image

# Container operations
docker run -d -p 80:80 --name web nginx  # Run container
docker ps                                # List running containers
docker ps -a                             # List all containers
docker stop web                          # Stop container
docker start web                         # Start container
docker rm web                            # Remove container

# Logs and debugging
docker logs web                   # View container logs
docker logs -f web               # Follow logs in real-time
docker exec -it web bash         # Execute bash in container
docker inspect web               # Detailed container info

Dockerfile Best Practices

1. Multi-stage Builds

Reduce image size with multi-stage builds:

# Build stage
FROM node:18-alpine AS builder
WORKDIR /app

COPY package*.json ./
RUN npm ci --only=production

COPY . .
RUN npm run build

# Production stage
FROM nginx:alpine
COPY --from=builder /app/dist /usr/share/nginx/html
COPY nginx.conf /etc/nginx/nginx.conf

EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]

2. Security Best Practices

Always run containers as non-root users:

FROM node:18-alpine

# Create app user
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nextjs -u 1001

# Set ownership
WORKDIR /app
COPY --chown=nextjs:nodejs . .

# Switch to non-root user
USER nextjs

CMD ["node", "server.js"]

3. Optimize Image Size

FROM node:18-alpine

# Combine commands to reduce layers
RUN apk add --no-cache nginx && \
    rm -rf /var/cache/apk/*

# Copy only necessary files
COPY package*.json ./
RUN npm ci --only=production

COPY src/ ./src/

Docker Compose

Multi-Container Applications

Define your entire stack in docker-compose.yml:

version: '3.8'

services:
  web:
    build: .
    ports:
      - "80:80"
    environment:
      - NODE_ENV=production
      - DB_HOST=db
    depends_on:
      - db
      - redis
    restart: unless-stopped

  db:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB: myapp
      POSTGRES_USER: ${DB_USER}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    volumes:
      - redis_data:/data
    restart: unless-stopped

volumes:
  postgres_data:
  redis_data:

Common Compose Commands

# Start all services
docker-compose up -d

# View logs
docker-compose logs -f

# Stop all services
docker-compose down

# Rebuild and restart
docker-compose up -d --build

# Scale a service
docker-compose up -d --scale web=3

Production Deployment

Health Checks

Add health checks to your containers:

# Dockerfile health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost/health || exit 1

Or in docker-compose.yml:

services:
  web:
    image: nginx
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

Resource Limits

Always set resource limits in production:

services:
  web:
    image: nginx
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M

Monitoring and Logging

Container Monitoring

Monitor container resource usage:

# Real-time stats for all containers
docker stats

# Stats for specific container
docker stats web

# One-time snapshot
docker stats --no-stream

Centralized Logging

Configure logging drivers:

services:
  web:
    image: nginx
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
        labels: "production,web"

Backup and Recovery

Volume Backups

Backup Docker volumes:

#!/bin/bash
VOLUME_NAME="myapp_data"
BACKUP_FILE="backup_$(date +%Y%m%d_%H%M%S).tar.gz"

# Create backup
docker run --rm \
  -v $VOLUME_NAME:/data \
  -v $(pwd):/backup \
  alpine tar czf /backup/$BACKUP_FILE -C /data .

echo "✓ Backup created: $BACKUP_FILE"

Restore from Backup

#!/bin/bash
VOLUME_NAME="myapp_data"
BACKUP_FILE="backup_20240110_120000.tar.gz"

# Restore data
docker run --rm \
  -v $VOLUME_NAME:/data \
  -v $(pwd):/backup \
  alpine sh -c "cd /data && tar xzf /backup/$BACKUP_FILE"

echo "✓ Data restored from: $BACKUP_FILE"

Security Best Practices

Image Security

• Use official base images
• Scan images for vulnerabilities
• Keep images updated
• Remove unnecessary packages
• Implement image signing
• Use private registries

Runtime Security

# Run container with limited privileges
docker run --rm \
  --read-only \
  --tmpfs /tmp \
  --cap-drop ALL \
  --cap-add NET_BIND_SERVICE \
  --security-opt no-new-privileges \
  nginx

Conclusion

Docker containerization provides consistency, portability, and efficiency for modern application deployment. Key takeaways:

1. Start simple, add complexity as needed
2. Always use multi-stage builds for production
3. Implement health checks and resource limits
4. Monitor and log everything
5. Plan for backup and disaster recovery

Next Steps: Explore orchestration platforms like Kubernetes or Docker Swarm for managing containers at scale.

Written by Dzubayyan Ahmad | System Administrator & SRE