Docker Captain Advice

Docker

What is Docker?

VM Workload

We need to isolate the app components from the host environment

Docker Workload

Resouce Isolation

Implemented by a number of Linux APIs:

• cgroups: Restrict resources a process can consume
  • CPU,
  • Memory
  • Disk IO,..
• namespaces: Change a process’s view of the system
  • Network Interfaces,
  • PIDs,
  • Users,
  • Mounts,…
• capabilities: Limit what a user can do
  • mount,
  • kill,
  • chown,…
• chroots: Determines what parts of the filesystem a users can see