Docker on Alperen Doc

docker-kurulum-hardening-debian

Mon, 01 Jan 0001 00:00:00 +0000

Debian 13 İçin Güvenli Docker ve Docker Compose Kurulum Dokümantasyonu#

1. Sistem Hazırlığı ve Bağımlılıklar#

Kuruluma başlamadan önce sistemin güncel olduğundan ve paketleri HTTPS üzerinden alabilmek için gerekli araçların yüklendiğinden emin oluyoruz.

sudo apt update && sudo apt upgrade -y
sudo apt install -y ca-certificates curl gnupg

2. Resmi Docker Deposu ve GPG Anahtarının Eklenmesi#

Paketlerin bütünlüğünü doğrulamak için Docker’ın resmi GPG anahtarını eklemek güvenlik açısından zorunludur.

GPG anahtarını indirip yapılandırıyoruz:

sudo install -m 0755 -d /etc/apt/keyrings
sudo rm -f /etc/apt/keyrings/docker.gpg
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

rm -f satırını ekledik çünkü anahtar daha önce indirilmişse gpg --dearmor -o komutu “File exists” hatası verir. Bu sayede komut güvenle tekrar çalıştırılabilir.

manage-docker-as-non-root-user

Mon, 01 Jan 0001 00:00:00 +0000

Manage Docker as a non-root user #

The Docker daemon binds to a Unix socket, not a TCP port. By default it’s the root user that owns the Unix socket, and other users can only access it using sudo. The Docker daemon always runs as the root user.

If you don’t want to preface the docker command with sudo, create a Unix group called docker and add users to it. When the Docker daemon starts, it creates a Unix socket accessible by members of the docker group. On some Linux distributions, the system automatically creates this group when installing Docker Engine using a package manager. In that case, there is no need for you to manually create the group.

docker-containers-images

Mon, 01 Jan 0001 00:00:00 +0000

Containers#

A container is a standard unit of software that packages up code and all its dependencies so the application runs quickly and reliably from one computing environment to another.

– Docker

Containers, on the other hand, gives us 90% of the benefits of virtual machines, but are super lightweight. Containers boot up in seconds, while virtual machines can take minutes.

Virtual Machine Architecture#

Container (Docker) Architectures#

docker-volumes

Mon, 01 Jan 0001 00:00:00 +0000

Volumes#

By default, Docker containers don’t retain any state from past containers. For example, if I:

Start a container from an image
Make some changes to the filesystem (like installing a new package) in that container
Stop the container
Start a new container from the same image
The new container does not have the changes I made in step 2.

However, if I restart the stopped container, it will have the changes I made. This is only worth mentioning because sometimes developers think that killing an old container and starting a new one is the same as restarting a process - but that’s not true… it’s more like resetting the state of the entire machine to the original image.

docker-build

Mon, 01 Jan 0001 00:00:00 +0000

Dockerfiles#

Docker isn’t only useful for running other people’s software (as we’ve been doing so far). It’s also a great way to build and package our own software.

I’ve used Docker both ways. As a DevOps/platform engineer I’m usually using other’s images, but as a backend developer I was usually building images for our own servers.

Docker images are built from Dockerfiles. A Dockerfile is just a text file that contains all the commands needed to assemble an image. It’s essentially the “Infrastructure as Code” (IaC) for an image. It runs commands from top to bottom, kind of like a shell script.

optimize-container-images-with-multi-stage-builds

Mon, 01 Jan 0001 00:00:00 +0000

The problem with single-stage builds#

When you use the golang image to compile and run a Go application in the same stage, the final image inherits the entire Go compiler toolchain - over 800MB of packages and hundreds of CVEs that you don’t need at runtime.

Note: Single-stage Go builds keep the full compiler toolchain (~800MB+) in the final image even though only the compiled binary is needed at runtime.

docker-network

Mon, 01 Jan 0001 00:00:00 +0000

Docker-Network#

Offline#

Now, let’s force a container into offline mode!

You might be thinking, “why would I want to turn off networking?!?” Well, usually it’s for security reasons. You might want to remove the network connection from a container in one of these scenarios:

You’re running 3rd party code that you don’t trust, and it shouldn’t need network access
You’re building an e-learning site, and you’re allowing students to execute code on your machines
You know a container has a virus that’s sending malicious requests over the internet, and you want to do an audit

Network None#

The docker run command has a --network none flag that makes it so that the container can’t network with the outside world, which is super useful for isolating containers.

docker-exec-shell

Mon, 01 Jan 0001 00:00:00 +0000

Exec#

When it comes to deploying applications with Docker, you’ll usually just let the container do its thing. For example, the Ghost container we ran in the last chapter started up its own web server (based on the image configuration). We didn’t need to run any manual commands in addition to just starting the container.

That said, it is possible to run commands inside a running container! It’s kinda like the container version of sshing into a remote server and running a command.

docker-logs

Mon, 01 Jan 0001 00:00:00 +0000

Docker Logs#

When containers are running in detached mode with the -d flag, you don’t see any output in your terminal, which is nice for keeping your terminal clean, but what if something goes wrong?

Enter the docker logs command.

docker logs [OPTIONS] CONTAINER

Ornek log#

Let’s run the Linux alpine image in a new container in detached mode, and give it a simple command to run to generate some standard output:

docker run -d --name logdate alpine sh -c 'while true; do echo "LOGGING: $(date)"; sleep 1; done'

The sh -c 'while true; do echo "LOGGING: $(date)"; sleep 1; done' part is just a simple shell script to execute inside the container that prints the current date and time every second.

docker-compose-basic

Mon, 01 Jan 0001 00:00:00 +0000

docker compose ne isimize yariyor dersek, birden fazla konteyneri tek bir yaml dosyasindan yonetmemize yariyor, tek tek docker run ile ugrasmiyoruz ve ayni zamanda restart sayesinde sistem acilinca uygulamayi otomatik ayakta tutabiliyoruz

temel calisma mantigi#

proje klasorunde docker-compose.yml diye bir dosya aciyoruz, icine servisleri, networkleri ve volumeleri yazip sonra compose bunlari otomatik kurup birbirine bagliyor ve dayyum! uygulamalar ayakta oluyor, istegimize gore state’ini ayarlayabiliyoruz

ornek 1 - tier1 (docker-compose.yml)#

asagidaki ornekte bir nginx web sunucusu ve bir postgres veritabani var, en cok kullandigimiz temel seyler icinde.

var-olan-volume-uzerine-docker-compose

Mon, 01 Jan 0001 00:00:00 +0000

İlk olarak ben örnek olarak vereceğim#

kullanmak istediğim uygulama (filebrowser) kurulum yaparken admin kullanıcının yanında rastgele encrypted şifre oluşturuyor arka planda calisirken ve `docker logs` da baktigimdada parolayi goruntuleyemedigimden boyle bir yol izledim#

docker compose up -d # -d flag arka planda çalıştır demek

böyle yaptığımdan arka planda çalıştigindan parolayi olusturdu ama cikti olarak vermedi onuda olusturdugu persistent volume yazdi ama ben görmedim

docker compose up

bana şifreyi verecekti ama çoktan iş işten geçti :D şifreyi de hash’li olarak sakladığından dosyalara girsem bile fayda vermeyecekti

docker-publish

Mon, 01 Jan 0001 00:00:00 +0000

Publishing to Docker Hub#

Let’s publish the Go server we Dockerized up to Docker Hub.

Rebuild the Go binary:

GOOS=linux GOARCH=amd64 go build

Rebuild the image. You’ll need to use a name that corresponds to your namespace on Docker Hub. Swap out USERNAME for your Docker Hub username.

docker build . -t USERNAME/goserver

Run your image in a container to make sure it still works:

docker run -p 8991:8991 USERNAME/goserver

Push the image to Docker Hub:

docker push USERNAME/goserver

Delete and Pull#

Let’s delete our local copy of the image, then pull it back down from Docker Hub. Just like with GitHub, the nice thing about having images in the cloud is that if something happens to your computer, or you’re working on another machine, you can always pull down your images.

docker-kurulum-hardening-rocky

Mon, 01 Jan 0001 00:00:00 +0000

Rocky Linux İçin Güvenli Docker ve Docker Compose Kurulum Dokümantasyonu#

1. Sistem Hazırlığı ve Bağımlılıklar#

Kuruluma başlamadan önce sistemin güncel olduğundan ve Docker deposunu yönetmemizi sağlayacak araçların yüklendiğinden emin oluyoruz.

sudo dnf update -y
sudo dnf install -y dnf-plugins-core

2. Resmi Docker Deposunun Eklenmesi#

Docker, Rocky için ayrı bir depo yayınlamıyor; RHEL türevleri için tek bir depo tutuyor ve bu depo CentOS olarak adlandırılıyor. Rocky’de de bu depoyu kullanıyoruz:

sudo dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo

Rocky 10’da paket yöneticisi dnf5’e geçti; orada komut biraz farklı: sudo dnf config-manager addrepo --from-repofile=https://download.docker.com/linux/centos/docker-ce.repo. Rocky 9’da (dnf4) yukarıdaki komut olduğu gibi çalışır.

docker-distroless-container-images

Mon, 01 Jan 0001 00:00:00 +0000

Distroless Container Image’leri: İçlerinde Ne Var, Neden Kullanılır?#

1. Distroless Nedir, Neden Var?#

debian, ubuntu veya türevlerinden (node:lts, python:3 gibi) FROM ile başlayan container image’leri, genellikle dolu dolu bir Linux dağıtımıyla birlikte gelir. Gündelik işler için harikadır ama çoğu container uygulaması çalışma zamanında bu araçların ve kütüphanelerin neredeyse hiçbirine ihtiyaç duymaz. Sonuç? Teknik bir gerekçe olmaksızın daha büyük image boyutu ve yönetmesi gereken daha fazla güvenlik açığı (CVE).

Küçük, güvenli image’ler üretme isteği gayet doğal. Bunun en ekstrem yolu FROM scratch ile başlamaktır; yani boş bir base image’e sadece uygulamamızın gerçekten ihtiyaç duyduğu dosyaları eklemek. Ancak FROM scratch ile başlayan container’lar varsayılan olarak şunları içermez:

Docker on Alperen Doc

docker-kurulum-hardening-debian

Debian 13 İçin Güvenli Docker ve Docker Compose Kurulum Dokümantasyonu#

1. Sistem Hazırlığı ve Bağımlılıklar#

2. Resmi Docker Deposu ve GPG Anahtarının Eklenmesi#

manage-docker-as-non-root-user

Manage Docker as a non-root user#

docker-containers-images

Containers#

Virtual Machine Architecture#

Container (Docker) Architectures#

docker-volumes

Volumes#

docker-build

Dockerfiles#

optimize-container-images-with-multi-stage-builds

The problem with single-stage builds#

docker-network

Docker-Network#

Offline#

Network None#

docker-exec-shell

Exec#

docker-logs

Docker Logs#

Ornek log#

docker-compose-basic

temel calisma mantigi#

ornek 1 - tier1 (docker-compose.yml)#

var-olan-volume-uzerine-docker-compose

İlk olarak ben örnek olarak vereceğim#

kullanmak istediğim uygulama (filebrowser) kurulum yaparken admin kullanıcının yanında rastgele encrypted şifre oluşturuyor arka planda calisirken ve docker logs da baktigimdada parolayi goruntuleyemedigimden boyle bir yol izledim#

docker-publish

Publishing to Docker Hub#

Delete and Pull#

docker-kurulum-hardening-rocky

Rocky Linux İçin Güvenli Docker ve Docker Compose Kurulum Dokümantasyonu#

1. Sistem Hazırlığı ve Bağımlılıklar#

2. Resmi Docker Deposunun Eklenmesi#

docker-distroless-container-images

Distroless Container Image’leri: İçlerinde Ne Var, Neden Kullanılır?#

1. Distroless Nedir, Neden Var?#

Manage Docker as a non-root user #

kullanmak istediğim uygulama (filebrowser) kurulum yaparken admin kullanıcının yanında rastgele encrypted şifre oluşturuyor arka planda calisirken ve `docker logs` da baktigimdada parolayi goruntuleyemedigimden boyle bir yol izledim#