DEV Community

Aisalkyn Aidarova
Aisalkyn Aidarova

Posted on

Part 3: Security, Registries, Resource Management, Logging, Monitoring, Troubleshooting, CI/CD, ECS, and Kubernetes

At this point you understand:

  • Docker Architecture
  • Images and Containers
  • Dockerfiles
  • Layers
  • Caching
  • Volumes
  • Networking
  • Docker Compose

Now we move into the topics that a DevOps Engineer with 6 years of experience deals with in production every day.

This is where most interview questions come from.

Docker Security

Most Docker breaches are not caused by Docker itself.

They are caused by poor configuration.

A senior DevOps engineer must always think:

How can this container be compromised?
Enter fullscreen mode Exit fullscreen mode

Why Security Matters

Imagine you run:

docker run ubuntu
Enter fullscreen mode Exit fullscreen mode

as root.

Inside the container:

Application
|
Root User
Enter fullscreen mode Exit fullscreen mode

If an attacker compromises the application:

Attacker
   |
Application
   |
Root User
Enter fullscreen mode Exit fullscreen mode

the attacker gains full control inside the container.

Root User Problem

Many developers create Dockerfiles like this:

FROM node:20

COPY . .

CMD ["npm","start"]
Enter fullscreen mode Exit fullscreen mode

The application runs as:

root
Enter fullscreen mode Exit fullscreen mode

This is dangerous.

Running Containers as Non-Root

Better:

FROM node:20

RUN useradd appuser

USER appuser

COPY . .

CMD ["npm","start"]
Enter fullscreen mode Exit fullscreen mode

Now application runs as:

appuser
Enter fullscreen mode Exit fullscreen mode

instead of root.

Why Companies Require This

Security teams often scan images.

If image runs as root:

Security Violation
Enter fullscreen mode Exit fullscreen mode

Pipeline may fail.

Many banks require:

No Root Containers
Enter fullscreen mode Exit fullscreen mode

before deployment.

Image Vulnerabilities

Imagine your image contains:

OpenSSL
Java
Python
Linux Packages
Enter fullscreen mode Exit fullscreen mode

One package contains a vulnerability.

Your application becomes vulnerable.

Image Scanning

DevOps engineers scan images before deployment.

Common tools:

Example:

trivy image myapp:v1
Enter fullscreen mode Exit fullscreen mode

Output:

Critical: 2
High: 5
Medium: 14
Enter fullscreen mode Exit fullscreen mode

You must fix vulnerabilities before production.

Secrets Management

Never do this:

ENV DB_PASSWORD=password123
Enter fullscreen mode Exit fullscreen mode

or:

password="password123"
Enter fullscreen mode Exit fullscreen mode

inside source code.

Why?

Image is stored in:

  • Docker Hub
  • ECR
  • Artifact Registry

Anyone with access can see it.

Proper Secret Management

Use:

  • AWS Secrets Manager
  • AWS Parameter Store
  • Kubernetes Secrets
  • HashiCorp Vault

A senior DevOps engineer never stores secrets inside images.

Docker Registries

What happens after image creation?

Example:

docker build -t app:v1 .
Enter fullscreen mode Exit fullscreen mode

Image exists only locally.

Need centralized storage.

Registry Concept

Think:

GitHub → Source Code

Registry → Docker Images
Enter fullscreen mode Exit fullscreen mode

Common Registries

Docker Hub

Most popular public registry.

docker pull nginx
Enter fullscreen mode Exit fullscreen mode

actually pulls from Docker Hub.

Amazon ECR

Used heavily in AWS.

Amazon Web Services

Example:

docker push account.dkr.ecr.us-east-1.amazonaws.com/app:v1
Enter fullscreen mode Exit fullscreen mode

Enterprise Workflow

Developer pushes code:

GitHub
Enter fullscreen mode Exit fullscreen mode

Pipeline builds image:

Docker Build
Enter fullscreen mode Exit fullscreen mode

Pipeline pushes image:

ECR
Enter fullscreen mode Exit fullscreen mode

Deployment platform:

ECS
EKS
Kubernetes
Enter fullscreen mode Exit fullscreen mode

pulls image from ECR.

Docker Resource Limits

One container can consume all server resources.

Example:

Container A
Enter fullscreen mode Exit fullscreen mode

starts using:

100% CPU
64 GB RAM
Enter fullscreen mode Exit fullscreen mode

Other applications fail.

Limiting CPU

Example:

docker run --cpus="2" nginx
Enter fullscreen mode Exit fullscreen mode

Container can use:

2 CPUs
Enter fullscreen mode Exit fullscreen mode

maximum.

Limiting Memory

Example:

docker run -m 2g nginx
Enter fullscreen mode Exit fullscreen mode

Container can use:

2 GB RAM
Enter fullscreen mode Exit fullscreen mode

maximum.

Why This Matters

Production server:

64 GB RAM
Enter fullscreen mode Exit fullscreen mode

10 containers.

Without limits:

One container
|
Consumes everything
Enter fullscreen mode Exit fullscreen mode

Server becomes unstable.

OOM Killer

Very important interview topic.

OOM:

Out Of Memory
Enter fullscreen mode Exit fullscreen mode

Linux kills processes when memory runs out.

Symptoms:

Container Restarting
Container Crashing
Exit Code 137
Enter fullscreen mode Exit fullscreen mode

Senior engineers immediately recognize:

Memory issue
Enter fullscreen mode Exit fullscreen mode

Docker Logging

Applications generate logs.

Examples:

User Login
Database Error
API Request
Enter fullscreen mode Exit fullscreen mode

Need visibility.

Viewing Logs 

docker logs container_id
Enter fullscreen mode Exit fullscreen mode

Live monitoring:

docker logs -f container_id
Enter fullscreen mode Exit fullscreen mode

Production Logging Architecture

Applications write logs:

Container
   |
Docker Logs
   |
Log Aggregation
Enter fullscreen mode Exit fullscreen mode

Common tools:

Monitoring Containers

DevOps engineers monitor:

CPU
Memory
Disk
Network
Errors
Enter fullscreen mode Exit fullscreen mode

Docker Stats

Quick monitoring:

docker stats
Enter fullscreen mode Exit fullscreen mode

Output:

CPU
Memory
Network
Block IO
Enter fullscreen mode Exit fullscreen mode

for every container.

Enterprise Monitoring Stack

Example:

Node Exporter
     |
Prometheus
     |
Grafana
Enter fullscreen mode Exit fullscreen mode

Exactly what you teach in your DevOps bootcamp.

Container Troubleshooting

This is where senior engineers spend significant time.

Scenario 1

Application not working.

Check:

docker ps
Enter fullscreen mode Exit fullscreen mode

Question:

Is container running?
Enter fullscreen mode Exit fullscreen mode

Scenario 2

Container stopped.

Check:

docker ps -a
Enter fullscreen mode Exit fullscreen mode

Output:

Exited (1)
Enter fullscreen mode Exit fullscreen mode

Container crashed.

Scenario 3

Find error.

docker logs container_id
Enter fullscreen mode Exit fullscreen mode

Example:

Database connection failed
Enter fullscreen mode Exit fullscreen mode

Root cause found.

Scenario 4

Enter container.

docker exec -it container_id bash
Enter fullscreen mode Exit fullscreen mode

Now inspect:

ls
cat
curl
ping
env
Enter fullscreen mode Exit fullscreen mode

Scenario 5

Inspect configuration.

docker inspect container_id
Enter fullscreen mode Exit fullscreen mode

Shows:

Networks
Volumes
Mounts
Environment Variables
IP Address
Enter fullscreen mode Exit fullscreen mode

CI/CD with Docker

Modern deployment flow:

Developer
   |
GitHub
   |
Jenkins
   |
Docker Build
   |
Image Scan
   |
Push To ECR
   |
Deploy
Enter fullscreen mode Exit fullscreen mode

Example Jenkins Pipeline

Stage 1:

npm test
Enter fullscreen mode Exit fullscreen mode

Stage 2:

docker build
Enter fullscreen mode Exit fullscreen mode

Stage 3:

trivy scan
Enter fullscreen mode Exit fullscreen mode

Stage 4:

docker push
Enter fullscreen mode Exit fullscreen mode

Stage 5:

deploy
Enter fullscreen mode Exit fullscreen mode

Docker and ECS

A question you often ask students.

Many people misunderstand ECS.

What ECS Does

Docker creates container.

Example:

Docker Image
Enter fullscreen mode Exit fullscreen mode

ECS manages container.

Think:

Docker = Container Technology

ECS = Container Management Platform
Enter fullscreen mode Exit fullscreen mode

Deployment Flow

Developer:

Build Image
Enter fullscreen mode Exit fullscreen mode

Push:

ECR
Enter fullscreen mode Exit fullscreen mode

ECS:

Pull Image
Enter fullscreen mode Exit fullscreen mode

Launch:

Task
Enter fullscreen mode Exit fullscreen mode

ECS Components

Cluster

Logical group of resources.

Example:

Production Cluster
Enter fullscreen mode Exit fullscreen mode

Task Definition

Blueprint.

Contains:

Image
CPU
Memory
Ports
Environment Variables
Enter fullscreen mode Exit fullscreen mode

Task

Running container instance.

Service

Keeps tasks alive.

Example:

Desired:

3 Tasks
Enter fullscreen mode Exit fullscreen mode

One task crashes.

Service automatically starts another.

Fargate and Docker

Without Fargate:

EC2
Docker
Containers
Enter fullscreen mode Exit fullscreen mode

You manage servers.

With Fargate:

Container
|
Fargate
|
AWS Manages Servers
Enter fullscreen mode Exit fullscreen mode

Huge operational savings.

Docker and Kubernetes

Most senior-level interviews include this topic.

Relationship

Docker creates container.

Kubernetes manages containers.

Think:

Docker = Engine

Kubernetes = Orchestrator
Enter fullscreen mode Exit fullscreen mode

Why Kubernetes Exists

One server:

5 Containers
Enter fullscreen mode Exit fullscreen mode

Easy.

Hundreds of servers:

5000 Containers
Enter fullscreen mode Exit fullscreen mode

Impossible manually.

Kubernetes automates:

Scheduling
Scaling
Recovery
Networking
Updates
Enter fullscreen mode Exit fullscreen mode

Real Production Architecture 

Users
   |
Load Balancer
   |
Kubernetes / ECS
   |
Frontend Containers
   |
Backend Containers
   |
Database
Enter fullscreen mode Exit fullscreen mode

What a 6-Year DevOps Engineer Must Know About Docker

A senior DevOps engineer should be able to explain:

Architecture

  • Docker Engine
  • Images
  • Containers
  • Registries

Dockerfile

  • Layers
  • Caching
  • Multi-stage builds

Storage

  • Volumes
  • Bind mounts
  • Persistence

Networking

  • Bridge
  • Host
  • Overlay
  • DNS
  • Port Mapping

Security

  • Non-root containers
  • Vulnerability scanning
  • Secrets management

Operations

  • Logs
  • Monitoring
  • Troubleshooting
  • Resource limits

Cloud Integration

  • ECR
  • ECS
  • Fargate
  • EKS
  • Kubernetes

CI/CD

  • Jenkins
  • GitHub Actions
  • GitLab CI/CD
  • Automated image scanning
  • Automated deployments

If a company hires a DevOps engineer with 6 years of experience, they expect that person not only to run Docker containers, but to design, secure, monitor, troubleshoot, and operate containerized applications in production at scale.

Top comments (0)