Docker Foundation Summary – Penetration Testing

Docker introduction

Docker client and server (daemon)

Docker image


Docker container

Docker container is built on the mirror above, we can understand the image as a defined class, and container is an instance, a class can instantiate a lot of examples, the same docker can also run on the mirror multiple containers, each The container can be the same or it can be customized. Docker client and server can run on the same host, can also be different.
The registry is used to store the user’s image, which is divided into public and private. Docker company operating public registry called docker hub, the user can docker hub registered account, share and save their own mirror.

Docker install

Docker can run on linux, mac, windows.

Install docker

Go to the official website to download the installation package:
download after the direct installation, the installation is completed after the run docker run hello-world, if no error, indicating successful installation.

Install docker on Linux

Install docker:

sudo apt-key adv –keyserver hkp:// –recv-keys 58118E89F3A912897C070ADBF76221572C52609D
sudo apt-add-repository ‘deb ubuntu-xenial main’
sudo apt-get update
apt-cache policy docker-engine
sudo apt-get install -y docker-engine

Start the docker daemon:

sudo service docker start
sudo /etc/init.d/docker start

Docker basic command

The docker base command contains the docker operation, the mirror operation, the container operation, and other related operations. Here are some common commands, please refer to the official documentation, or use the -help command.

Docker operation

View the docker information

$docker info
Containers: 1
Running: 1
Paused: 0
Stopped: 0
Images: 5
Server Version: 1.12.3

View the docker version

$docker -v
Docker version 1.12.3, build 6b644ec
$docker version
Version: 1.12.3
API version: 1.24
Go version: go1.6.3
Git commit: 6b644ec
Built: Wed Oct 26 23:26:11 2016
OS/Arch: darwin/amd64
Version: 1.12.3
API version: 1.24
Go version: go1.6.3
Git commit: 6b644ec
Built: Wed Oct 26 23:26:11 2016
OS/Arch: linux/amd64

Mirror operation

Local images are stored in the /var/lib/docker directory.
View the local mirror list:

docker images -a

Other mirroring operations:

docker search (image-name)
docker history (image-name)
docker push (image-name)
docker pull image-name:tag pull
docker rmi
docker rmi $(docker images -q)
docker tag image-id imagename:tag
docker load -i test.tar
docker save image > test.tar

Container operation

Create container:

docker run –rm -ti ubuntu /bin/bash

-rm Once the process exits, the container is deleted

-ti Enter interactive mode

Ubuntu container based on the mirror name

/bin/bash The command to run

docker run -d -p 8000:80 –name test image-name

-d running in the background

-p mapping of the port, the former for the machine, after the container

-name custom name

Note: After creating the container, it will return an ID that is generated randomly.

Check container operating status:

docker ps -a

View container specific information:

docker inspect

More detailed than the ps-a command, including network information, configuration information and other content, you can match with -format, such as:

sudo docker inspect –format ” c18acd6a8a32

View the process inside the container:

docker top container_id

Into the container interior:

sudo docker attach container_id

Or you can use:

docker exec -ti container_name /bin/bash

Exec command can be executed inside the container command, the above code that the container to create a new shell.

Exit container:


Reboot container:

drocker run —restart=always

The restart parameter can set the following:

The docker container is restarted regardless of the code program exiting the container

On-failure You can specify an exit code

More container operation:

docker attach container
docker diff container
dcoker logs ID
docker stop ID
docker start ID
docker restart ID
docker stop ID docker rm ID
docker kill [options] container
docker stop $(docker ps -a -q)
docker rm $(docker ps -a -q)
docker commit ID new
docker export container > test.tar
docker cp container:path hostpath

Container network management:

Host mode, the use of dockerrun use -net = host specified (docker used in the network and the host is actually the same, in the container to see the network card ip is the host ip)

Container mode, use-net = container: container_id/container_name (multiple containers using a common network, see ip is the same)

None mode, specified with -net = none (in this mode, no network is configured)

Bridge mode, specified with -net = bridge

Default mode, do not specify the default is this network mode. (This mode assigns a separate Network Namespace to each container, similar to vmware’s nat network mode. All containers on the same host will be able to communicate with each other under the same network segment.)

Other operation

docker import
docker login [options][server]
docker inspect container/image
docker wait container


Dockerfile can be used to dynamically generate a new image, for example, we pull a basic centos mirror, now need to install some of the software in this mirror, so that we can run the project code we prepared, then you can use the following two options:

Option 1: (manual)

In the centos mirror to create a container, enter the container interactive interface, manually install some of the necessary software, configure the environment. After doing all the changes, use the docker commit container-id newimagename to create a new image. Then use the new image to create the container, run our project code.

Option 2: (automatic)

The so-called automation, that is, do not need to enter the container manually enter the command to configure, everything is automatically handled when the container is running, then it will use the dockerfile. Dockerfile is simply a configuration file, docker container at run time will handle the contents of the file, such as the installation of software, modify the environment variables, run the program. The advantage of using dockerfile is that you can easily modify the contents of the configuration file to achieve the effect of creating dynamic images.

Create a dockerfile

We need to create a directory to store Dockerfile file, the directory name can be arbitrarily taken in the directory to create Dockerfile file. Here I am going to create a base based on centos mirror, the container will automatically open a python webserver (local monitor 8080 port) example.

Write a dockerfile

In the Dockerfile file to write:

# Version 0.1
FROM centos:latest
RUN apt-get install wget
CMD python -m SimpleHTTPServer 8080

The dockerfile syntax is similar to MakeDown, based on the following:

FROM based on the base mirror name

MAINTAINER maintainer information

RUN run command (install software, etc.)

CMD command to run the container (can only write one)

Grammar more than these, more content, you can refer to the official documents.

Generate dockerfile image

Into the directory where the Dockerfile file is located, run:

docker build -t centos_test:01 .
docker build -t centos_test:01 git@github:……

At this point, run docker images-a view, will find more than one image, named centos_test, tag 01 If dockerfile write a problem, in the build will be given, then you can docker run container id into the final state of the container to debug.

Use dockerfile to mirror

Run the container on this image:

docker run -d -p 80:8080 centos_test:0.1

At this point, open the machine

Dockerfile rules

Each instruction must be in uppercase letters, such as FROM, RUN, and followed by a content, docker file will be from the top down the order of the implementation of these content.


Role: set the working directory, similar to cd

WORKDIR /root/
RUN apt-get install pip
WORKDIR /root/test

You can override the container working directory with the -w parameter

docker run -w /root/nmasktools ……


Action: Set the environment variable
in the container to be overridden with -e.


Role: Specify what kind of user to run the container

USER ddos

You can use the docker-u to cover it.


Add and copy are used to add a file to the mirror, the difference is that copy can only copy the file, but no decompression function.

The post Docker Foundation Summary appeared first on Penetration Testing.


Deixe um comentário

Preencha os seus dados abaixo ou clique em um ícone para log in:

Logotipo do

Você está comentando utilizando sua conta Sair / Alterar )

Imagem do Twitter

Você está comentando utilizando sua conta Twitter. Sair / Alterar )

Foto do Facebook

Você está comentando utilizando sua conta Facebook. Sair / Alterar )

Foto do Google+

Você está comentando utilizando sua conta Google+. Sair / Alterar )

Conectando a %s