Docker networking and storage
You learn bridge, host and overlay networks, container DNS, volume drivers and data backups by looking at packets and files.
Level 201 · 16 lessons · 15 practice labs
Lessons
Container networks
- Inside the bridge network: veth, docker0, iptables
- User-defined networks and embedded DNS
- host, none and macvlan networks
- Port publishing and NAT rules
- IPv6 in containers
- Short task: separate the front-end and database networks
Network problems
- Name resolution problems from inside a container
- Capturing packets on a container network
- Short task: the app can’t reach its database: find out why
Storage
- Storage drivers and overlayfs layers
- Volume drivers, tmpfs and NFS volumes
- Permissions and user IDs on volumes
- Backing up volumes and moving them to another machine
- Watching disk use with docker system df
- Short task: find and tame the container data that filled the disk
Wrap-up
- Capstone: design a two-network app environment with backups
Practice labs
- Find a container’s veth peer: Match each running container to its veth interface on the host using interface indexes, and produce a table of container name, interface and IP.
- The NAT rule behind a published port: Find the DNAT rule in iptables or nftables for a published port, show its counters rise with a curl request and briefly explain the packet’s path.
- Large requests that drop now and then: On a container network where small requests pass but large responses hang, capture packets to find the MTU mismatch, rebuild the network with the right MTU and show the large response arrives.
- A container you can’t reach by name: Move two containers that can’t find each other by name on the default bridge to a user-defined network, and show ping and connections by name work.
- Switching versions with an alias: Start the new app version under the same network alias, move traffic over by detaching the old version and show the client now reaches the new version.
- No outside names from inside a container: Where containers resolve internal names but not outside ones, inspect the daemon DNS setting, resolv.conf and the embedded DNS to find the cause, fix it and show with dig both kinds of name resolve.
- A batch job with no network: Run the batch job that processes sensitive files in a container with no network, and show it finishes successfully but cannot open any outside connection.
- A port clash on the host network: Find with ss the port where a host-network monitoring container clashes with a service on the host, resolve the clash and show both services answer.
- Keep the front end away from the database: Split Atlas Clinic’s app into front and internal networks, make the internal one without outside access, and prove the front end can’t reach the database, the database can’t reach the internet, and the app reaches both.
- tmpfs for scratch files: Mount the app’s temp folder as a size-limited tmpfs and show the contents vanish when the container restarts and the limit is enforced.
- Two users, one volume: Set up group and permissions so two containers running as different user ids can both write to the same volume, and show each can create files.
- An NFS volume that won’t mount: Work out from the error messages why Saltmarsh Fisheries’ shared NFS volume won’t mount because of wrong options, redefine the volume and prove a written file shows up on the NFS server.
- Who is using the disk?: Use docker system df and its verbose output to find the images, volumes and build cache taking the most space, and report the top five with sizes.
- A container log that filled the disk: Safely shrink the container log that filled the disk because it had no rotation, set up log rotation and show the new limits apply.
- Deleted but still taking space: Find files in a container’s writable layer that were deleted but are still held open by a process, reclaim the space without stopping the service and prove it with df.
About this course
You learn bridge, host and overlay networks, container DNS, volume drivers and data backups by looking at packets and files.
What you will learn
- Container networks
- Network problems
- Storage
- Wrap-up
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.