Containers are a type of construct that's used all over the world and I want to take this episode to
talk about it a little bit.
Now one of the places we use containers a lot is within the software development world and not being
a programmer I thought I'd bring in my ringer my pal Michael Speier to help me understand what is a
container.
OK.
I knew what a container is but you know he's more fun to talk to you sometimes.
All right so Mike let's start with the easy question.
What's a container it's just an application and all of its libraries in binary is running on top of
the host OS kernel.
Simple is that right.
OK so I understand virtual machines.
Can we start from there.
Can you give me a hand.
Yeah I will start at a little higher level than that and see if it makes a lot more sense.
If you're familiar with virtual machines and how they work you take one big one big server slap a hypervisor
on there and then you can run a whole bunch of different operating systems on there and they're all
isolated from each other.
Just because the hypervisor virtualise is the hardware of that system.
Exactly so each one has its own unique OS so that each of us looks at the virtual machine it's in and
to it it doesn't know any different that that's all there is in the world it doesn't realize it's running
on a machine that has either 10 or 100 other operating systems on it.
Are all isolated from each other.
That's a VM that's a VM and a container kind of does that for an application.
So as you can see we're my friends over here docker have come up with a nice diagram.
We're actually on the docker Web site right here and they do have a nice.
Go ahead please show the difference.
So whereas instead of running a whole bunch of full operating systems and all of their applications
next to each other we just have one operating system and then we run applications with their little
binary is in libraries that they need to run and they're all isolated from each other just like the
virtual machines are.
But these individual containers aren't the complete operating system.
As we look at this diagram we still have a host operating system.
So what they're doing is they're just like taking the kernel from the host OS and then they bring whatever
applications whatever libraries anything that they need configuration files whatever just for them.
Yes OK and you and whatever's running inside a container can only see what's inside its container.
It doesn't know that there's anything else in the world.
It doesn't have access to any of the underlying operating systems files or folders.
It can't see any networking that isn't explicitly allowed to see it's completely isolated from everything
else.
Ok cool.
Can I can I see a container please.
Sure.
Pull one up right now.
So what we're going to be using here guys is the pretty famous docker.
I'm not sure maybe they did maybe they'd think docker invented the concept of containers maybe they
did.
I don't know.
When you talk about containers within software development doctor really comes into play.
So what we're going to do here is take a minute and show you how doctor works with containers so what
are we doing right now.
So I'm going to show you some running containers.
And there we go.
Incredibly exciting as you can see.
Wait a minute so what.
What.
So we are looking at these are the containers that are running on this system right now.
Yes.
All right.
I'm not even bother trying to ask you what these containers are doing but they are up and running so
right now I've got one two three four five six different little containers.
Yes.
With little applications and they're just doing their own thing.
Yeah.
Each one of these is actually part of a larger whole.
They all talk to each other and you there are management servers in here there's database servers in
here there's web servers in here.
And each one is configured to do exactly what it needs to do.
So where do these containers come from.
What did Dr do to give me a container what containers are actually running part of a two party system
and the other part of it is called an image.
So we'll take a look at the images right now.
So these are the actual images we have.
So we asked machine.
So we have some I got to use right term here.
An image is just that's what sits on the hard drive I guess that's going to have the files the buying
Aeris the whatever I need.
And then when it's running then it's going to be a container.
Yeah it's almost very loosely it's kind of like the X-C just sitting on your hard drive for like Microsoft
Word or something it itself isn't doing anything it's just sitting there only when it's actually up
and running.
Do we call it a container.
OK.
So the important thing here is that I can start and stop containers just like I can start and stop virtual
machines.
Yes.
OK so very much isolated case so certainly get an idea of where this could be good because what's happening
now is like if I've got a a web server of some kind it a web app I can create a container that's just
going to have a web server in it maybe and my web app and maybe the right version of javascript.
Didn't I get in trouble when I tried to talk like a programmer.
I don't know what I mean but it would have having is this a super isolated stuff.
Yes.
And you would you have a certain version of Python.
Yeah exactly.
And when you build one of these images it has just what that application at that particular time needs
to run and nothing else.
So you you choose it you're going to start to write some code and get this new web app.
OK exactly.
So what you're going to do is make an image Yes build an image you create an image.
Exactly.
You build an image and then start with a docker file and I'm going to show you a kind of a complicated
one for one of the big projects and here you go this is what one will look like.
So you don't need to go through all the details but this is where it starts.
There's a couple of things that are interesting here for example there's environment stuff so I can
see path statements and things like that.
Yeah.
We're trying to in order to get much part of this run so it's actually got to run something.
Yeah.
Holy smoke it's running an apt get.
It's actually down.
Just like I run it get on Alexander's time to update something in.
This is essentially a Linux system underneath.
It just it's everything that in this case an ability to machine without the actual Linux kernel.
So it's everything that's above that.
So the whole thing that this guy is to do is to just open up a python.
It creates an environment to run Python.
So it goes and pulls everything down that Python will need to run.
I thought I saw Can we go back to your images images did I not see a python in there yet.
In fact we've already downloaded a copy of Python.
You think we play in this.
Let's go ahead and run your Python.
So go ahead and actually run that.
So in this case I'm going run what's called an interactive session.
So well just Dr. run incredibly complex guys I assure you that security plus is not going to quiz you
on Doc or command line statements.
I just want to make sure we can get the idea of actually starting up a container and watching it go.
So I'm going to run my 3.6 Python image and then I'm going actually run the command Python.
In this case I'm going to tell the image what command I would like to run.
You saw on the the docker file that by default it would actually just run Python 3.
But in this case we're just going to run it manually.
So it's going to take an action.
There it is.
That's Python.
So we were just waiting for you know straight up interactive python here.
Exactly.
Can you do one plus one.
Is this like real Python.
It's real.
It's all over.
All right so.
OK.
It still looks like a VM.
What's the big difference here.
Well when I exit here you I'm back to my terminal command line command prompt but so that the container
is now exited it's now no longer running the container only lives to run whatever you have selected
is run in the moment whatever piece of that app or app gets turned off it's gone.
All right.
That makes sense.
So then I can see why people would use this and develop environ because not only do you have all this
wonderful isolation.
Right.
Not only do you have this incredible control over Vergini and all that type of stuff.
Not only do you get the security of the isolation but then more than that it literally lives only to
do that one thing.
Exactly.
And I can run as many of these as I want so if I need one copy of my Python or my web application running
I can just fired up if I need 10 if I need a hundred if I need 10000 I can use one image and spawn as
many containers from that as I need.
Cool.
All right.
Well Mike that's really the critical stuff I want to look at.
So what what what do we look at it right here.
Just showing you the actual images that are still running and exited so you can see right there at the
top there is the one we just ran with the command Python and directly below it is the one we ran while
we were rehearsing for this episode to make sure everything worked exactly.
Well that's pretty cool Mike.
Thanks.
Listen I appreciate you give me a tour of invaders.
But so you understand this is for security plus So there's going to be one takeaway that somebody who's
studying for security plus ought to know about containers.
What would that be.
Isolation.
They they keep your the container keeps the application isolated and actually keeps everything simpler
so you have less attack surface.
And if you are compromised they can't get access to the entire operating system and all the rest of
your critical data.
And so isolation and that's an reduce the texture of this or some of the most important parts of containerization
for Kerry.
Fantastic.
Thanks Mike.
No problem.