This is the feature of containers that the system administrator in me gets all excited about.
Ports.
This is more than security through obscurity, this is actually about isolated networking.
Docker has an internal network stack all to itself.
You can see it if you type ifconfig. You see a Docker interface (not unlike a Hyper-V Internal network vNIC).
If you have a container running you can use sudo docker ps and one of the columns is 'ports'.
Lets begin with the intermediate of exposing ports.
For my examples I have been using my meshblu image and opening a bash shell and even mapping local file paths into it. I am going to leave those out at the moment.
Now that I have a working model, I want to test it. So I want to expose the listener port of the service running in my container.
sudo docker run -t -t -p 3000:3000 --name meshblu meshblu_appliance
The -p command allows the mapping of ports.
If I only defined -p 3000 I would be allowing port 3000 of the container to be mapped to some random port of the container host. Instead I defined 3000:3000 - so as not to confuse myself.
What this does is map port 3000 of my container to port 3000 of my container host.
If I open any application on my container host or from a remote machine I can now access the application in my container on port 3000. Just like opening a single port in a firewall.
Now. My container has a number of supporting services such as Redis and MongoDB and other ports that the application will be listening on.. I would like to expose these as well. They are there, in the container, running and responding and entirely hidden at the moment.
This is one that I did not consider intuitive.
sudo docker run -t -t -p 3000:3000 -p 1883:1883 -p 5683:5683 --name meshblu meshblu_appliance
Now I have mapped two additional ports. Initially I tried using a single long string or an array (it just made sense) but you need to use individual port commands.
Just some other nifty stuff. And I have not gotten beyond a single container yet.
No comments:
Post a Comment