Container চালানো — lifecycle, port, volume, network আর resource limit

$ docker run -d --name abcl-dr-py python:3.12-alpine \
    python -c 'import time; time.sleep(600)'
8ecbd42c5176…
$ time docker stop -t 3 abcl-dr-py
abcl-dr-py
real    0m3.286s
$ docker inspect -f '{{.State.Status}} exit={{.State.ExitCode}}' abcl-dr-py
exited exit=137

$ docker run -d --init --name abcl-dr-i python:3.12-alpine \
    python -c 'import time; time.sleep(600)'
3afe0f8b50ad…
$ time docker stop abcl-dr-i
abcl-dr-i
real    0m0.274s
$ docker inspect -f '{{.State.Status}} exit={{.State.ExitCode}}' abcl-dr-i
exited exit=143

$ docker run -d --name abcl-dr-web --hostname demo -m 64m \
    -p 127.0.0.1:18391:80 nginx:1.27-alpine
dcdee61895cf…

$ docker logs --tail 2 abcl-dr-web
… [error] 31#31: *2 open() "/usr/share/nginx/html/nope" failed (2: No such file or…
… "GET /nope HTTP/1.1" 404 153 "-" "curl/8.18.0" "-"

$ docker exec abcl-dr-web sh -c 'ps -o pid,user,args | head -3'
PID   USER     COMMAND
    1 root     nginx: master process nginx -g daemon off;
   30 nginx    nginx: worker process

$ docker top abcl-dr-web -o pid,args
PID                 COMMAND
31645               nginx: master process nginx -g daemon off;
31691               nginx: worker process
…

$ docker stats --no-stream --format 'table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.MemPerc}}' abcl-dr-web
NAME          CPU %     MEM USAGE / LIMIT   MEM %
abcl-dr-web   0.00%     16.57MiB / 64MiB    25.89%

$ docker run -d --name abcl-dr-web --hostname demo \
    -p 127.0.0.1:18391:80 nginx:1.27-alpine
$ docker ps --filter name=abcl-dr-web --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'
NAMES         STATUS         PORTS
abcl-dr-web   Up 2 seconds   127.0.0.1:18391->80/tcp
$ docker port abcl-dr-web
80/tcp -> 127.0.0.1:18391
$ curl -sI http://127.0.0.1:18391/ | sed -n 1,2p
HTTP/1.1 200 OK
Server: nginx/1.27.5

$ docker run -d --name abcl-dr-web2 -p 127.0.0.1:18391:80 nginx:1.27-alpine
… Bind for 127.0.0.1:18391 failed: port is already allocated
$ docker ps -a --filter name=abcl-dr-web2 --format '{{.Names}} {{.Status}}'
abcl-dr-web2 Created

// Port-publishing conflict checker. Edit TRY and run again.
const TRY = [
  "127.0.0.1:8080:80",     // web
  "127.0.0.1:8080:80",     // second web, same address
  "127.0.0.1:8080:53/udp", // same number, other protocol
  "127.0.0.1:8081:80",     // other host port, same container port
  "9000:9000",             // no IP: all interfaces
  "127.0.0.1:9000:9000",   // overlaps the line above
];
function parse(spec) {
  const [ports, proto = "tcp"] = spec.split("/");
  const p = ports.split(":");
  const ip = p.length === 3 ? p[0] : "0.0.0.0";
  return { ip, port: +p[p.length - 2], cport: +p[p.length - 1], proto, spec };
}
const clash = (a, b) => a.proto === b.proto && a.port === b.port &&
  (a.ip === b.ip || a.ip === "0.0.0.0" || b.ip === "0.0.0.0");

const taken = [];
for (const spec of TRY) {
  const want = parse(spec);
  const hit = taken.find(t => clash(want, t));
  if (hit) {
    console.log(`FAIL  -p ${spec}`);
    console.log(`      Bind for ${want.ip}:${want.port} failed: held by -p ${hit.spec}`);
    continue;
  }
  taken.push(want);
  const open = want.ip === "0.0.0.0" ? "  WARNING: reachable from every network" : "";
  console.log(`OK    -p ${spec}${open}`);
}
console.log(`held: ${taken.length} of ${TRY.length} requests`);

$ docker run --name abcl-dr-w1 alpine:3.20 sh -c 'echo hello > /data.txt; cat /data.txt'
hello
$ docker rm abcl-dr-w1
$ docker run --rm --name abcl-dr-w2 alpine:3.20 sh -c 'cat /data.txt'; echo rc=$?
cat: can't open '/data.txt': No such file or directory
rc=1

# bind mount, read-only inside the container
$ echo '<h1>from host v1</h1>' > site/index.html
$ docker run -d --name abcl-dr-b -p 127.0.0.1:18392:80 \
    -v "$PWD/site:/usr/share/nginx/html:ro" nginx:1.27-alpine
$ curl -s http://127.0.0.1:18392/
<h1>from host v1</h1>
$ echo '<h1>from host v2</h1>' > site/index.html
$ curl -s http://127.0.0.1:18392/
<h1>from host v2</h1>
$ docker exec abcl-dr-b sh -c 'echo x > /usr/share/nginx/html/a.txt'
sh: can't create /usr/share/nginx/html/a.txt: Read-only file system

# tmpfs vs writable layer, same container started twice
$ docker run --name abcl-dr-t3 --tmpfs /scratch:size=1m alpine:3.20 \
    sh -c 'ls /scratch /root/; echo keep > /scratch/k; echo keep2 > /root/k2'
/root/:

/scratch:
$ docker start -a abcl-dr-t3
/root/:
k2

/scratch:

# client on the default bridge, server on abcl-dr-net
$ docker run --rm --name abcl-dr-cli alpine:3.20 wget -T 3 -qO- http://abcl-dr-api/; echo rc=$?
wget: bad address 'abcl-dr-api'
rc=1

# both on the default bridge
$ docker run -d --name abcl-dr-api2 nginx:1.27-alpine
$ docker run --rm --name abcl-dr-cli alpine:3.20 wget -T 3 -qO- http://abcl-dr-api2/; echo rc=$?
wget: bad address 'abcl-dr-api2'
rc=1

# attach a running container to the network, and the name works
$ docker run -d --name abcl-dr-lone alpine:3.20 sleep 60
$ docker exec abcl-dr-lone wget -T 3 -qO- http://abcl-dr-api/ | grep -c title
wget: bad address 'abcl-dr-api'
0
$ docker network connect abcl-dr-net abcl-dr-lone
$ docker exec abcl-dr-lone wget -T 3 -qO- http://abcl-dr-api/ | grep -i '<title'
<title>Welcome to nginx!</title>

$ cat oom.py
chunks = []
for i in range(1, 100):
    chunks.append(b"x" * (8 * 1024 * 1024))
    print(f"allocated {i * 8} MiB", flush=True)

$ docker run --name abcl-dr-oom --memory 64m --memory-swap 64m \
    -v "$PWD/oom.py:/oom.py:ro" python:3.12-alpine python /oom.py; echo "rc=$?"
allocated 8 MiB
…
allocated 48 MiB
allocated 56 MiB
rc=137
$ docker inspect -f 'exit={{.State.ExitCode}} oom={{.State.OOMKilled}} mem={{.HostConfig.Memory}} swap={{.HostConfig.MemorySwap}}' abcl-dr-oom
exit=137 oom=true mem=67108864 swap=67108864

// Memory limit and the OOM decision. Sizes in MiB. Edit CASES.
// app = what the program itself needs at start, chunk = each allocation.
const CASES = [
  { name: "--memory 64m --memory-swap 64m", limit: 64, total: 64, app: 8, chunk: 8, want: 800 },
  { name: "--memory 64m (swap not set)", limit: 64, total: 128, app: 8, chunk: 8, want: 800 },
  { name: "--memory 256m, app wants 120", limit: 256, total: 256, app: 8, chunk: 8, want: 120 },
];
function run(c) {
  let done = 0, swapPeak = 0;
  while (done + c.chunk <= c.want) {
    const next = c.app + done + c.chunk;
    if (next > c.total) {
      console.log(`  need ${next} > allowed ${c.total}: OOM kill`);
      return { exit: 137, oom: true, done, swapPeak };
    }
    done += c.chunk;
    swapPeak = Math.max(swapPeak, next - c.limit);
  }
  return { exit: 0, oom: false, done, swapPeak };
}
for (const c of CASES) {
  console.log(c.name);
  const r = run(c);
  console.log(`  allocated ${r.done} MiB, swap peak ${r.swapPeak} MiB`);
  console.log(`  exit=${r.exit} OOMKilled=${r.oom}`);
}

# burn.py: busy loop for 5 s of wall time, then print CPU used and cpu.stat
$ docker run --rm --name abcl-dr-cpu -v "$PWD/burn.py:/burn.py:ro" python:3.12-alpine python /burn.py
cpu.max: max 100000
wall 5.00s  cpu 5.00s  ratio 1.00  loops 78M
periods 0 throttled 0 throttled_sec 0.0

$ docker run --rm --name abcl-dr-cpu --cpus 0.5 -v "$PWD/burn.py:/burn.py:ro" python:3.12-alpine python /burn.py
cpu.max: 50000 100000
wall 5.00s  cpu 2.51s  ratio 0.50  loops 41M
periods 51 throttled 50 throttled_sec 2.49

$ docker run --rm --name abcl-dr-cpu --cpus 0.25 -v "$PWD/burn.py:/burn.py:ro" python:3.12-alpine python /burn.py
cpu.max: 25000 100000
wall 5.00s  cpu 1.26s  ratio 0.25  loops 20M
periods 52 throttled 51 throttled_sec 3.82

$ docker stats --no-stream --format 'table {{.Name}}\t{{.CPUPerc}}' abcl-dr-cpu
NAME          CPU %
abcl-dr-cpu   49.69%

// CPU limit as quota per 100 ms period. Wall time of one job.
const PERIOD = 100;                              // ms
function wall(cpuMs, cpus, threads) {
  const quota = Math.min(cpus * PERIOD, threads * PERIOD);
  let left = cpuMs, t = 0, stalls = 0;
  for (;;) {
    const run = Math.min(quota, left);
    left -= run;
    if (left <= 0) return { ms: t + run / threads, stalls };
    t += PERIOD;
    if (quota < threads * PERIOD) stalls++;     // quota ran out: frozen
  }
}
const JOBS = [
  [5000, 1, 1], [5000, 0.5, 1], [5000, 0.25, 1],
  [120, 2, 1], [120, 0.5, 1], [180, 0.25, 1],
  [40, 1, 8], [400, 1, 8],
];
console.log("cpu-ms  --cpus  threads  cpu.max        wall-ms  stalls");
for (const [cpu, cpus, th] of JOBS) {
  const r = wall(cpu, cpus, th);
  const max = `${cpus * 100000} 100000`;
  console.log(String(cpu).padStart(6), String(cpus).padStart(7),
    String(th).padStart(8), " " + max.padEnd(14), r.ms.toFixed(1).padStart(7),
    String(r.stalls).padStart(7));
}

$ docker run -d --name abcl-dr-r-no  --restart no             alpine:3.20 sh -c 'exit 1'
$ docker run -d --name abcl-dr-r-of  --restart on-failure:3   alpine:3.20 sh -c 'exit 1'
$ docker run -d --name abcl-dr-r-of0 --restart on-failure:3   alpine:3.20 sh -c 'exit 0'
$ docker run -d --name abcl-dr-r-al  --restart always         alpine:3.20 sh -c 'exit 0'
$ docker run -d --name abcl-dr-r-us  --restart unless-stopped alpine:3.20 sh -c 'exit 1'
# 12 seconds later, docker inspect -f with Name, RestartPolicy, RestartCount, Status, ExitCode
/abcl-dr-r-no  policy=no             count=0 status=exited     exit=1
/abcl-dr-r-of  policy=on-failure     count=3 status=exited     exit=1
/abcl-dr-r-of0 policy=on-failure     count=0 status=exited     exit=0
/abcl-dr-r-al  policy=always         count=7 status=restarting exit=0
/abcl-dr-r-us  policy=unless-stopped count=7 status=restarting exit=1
# docker stop on the last two, wait 3 s
/abcl-dr-r-al  count=7 status=exited exit=0
/abcl-dr-r-us  count=7 status=exited exit=1

// Restart policy with backoff, simulated clock (seconds).
function sim({ policy, retries = Infinity, exit, up, stopAt = Infinity, until }) {
  let t = 0, delay = 0.1, count = 0, last = "";
  const seen = [];                               // [time, count]
  for (;;) {
    t += up;                                     // the container runs, then exits
    if (t >= stopAt) { last = `docker stop at ${stopAt}s`; break; }
    const wants = policy === "always" || policy === "unless-stopped" ||
      (policy === "on-failure" && exit !== 0 && count < retries);
    if (!wants) { last = `policy says no (exit ${exit})`; break; }
    if (up >= 10) delay = 0.1;                   // ran 10 s or more: reset
    count++;
    seen.push([t, count]);
    if (t + delay >= until) { last = `still looping at ${until}s`; break; }
    t += delay;
    delay = Math.min(delay * 2, 60);             // double, cap at 1 minute
  }
  return { count, last, seen };
}
const at = (r, s) => r.seen.filter(x => x[0] <= s).length;

const crash = sim({ policy: "always", exit: 1, up: 0.25, until: 400 });
console.log("always, exit 1, 0.25 s each run");
console.log("  count at 3/6/9/15/30 s:", [3, 6, 9, 15, 30].map(s => at(crash, s)).join(" "));
console.log("  count at 2/5 min:", [120, 300].map(s => at(crash, s)).join(" "));
for (const c of [
  { policy: "no", exit: 1, up: 0.25, until: 60 },
  { policy: "on-failure", retries: 3, exit: 1, up: 0.25, until: 60 },
  { policy: "on-failure", retries: 3, exit: 0, up: 0.25, until: 60 },
  { policy: "always", exit: 1, up: 12, until: 300 },
  { policy: "unless-stopped", exit: 1, up: 0.25, stopAt: 20, until: 60 },
]) {
  const r = sim(c);
  console.log(`${c.policy} exit=${c.exit} up=${c.up}s -> count ${r.count}: ${r.last}`);
}

$ docker run --rm --name abcl-dr-ro --read-only alpine:3.20 sh -c 'touch /x; echo rc=$?'
touch: /x: Read-only file system
rc=1

$ docker run --name abcl-dr-ro --read-only nginx:1.27-alpine
…
nginx: [emerg] mkdir() "/var/cache/nginx/client_temp" failed (30: Read-only file system)
# exit=1. Give writable tmpfs only where nginx needs it:
$ docker run -d --name abcl-dr-ro --read-only --tmpfs /var/cache/nginx --tmpfs /run \
    -p 127.0.0.1:18393:80 nginx:1.27-alpine
$ curl -sI http://127.0.0.1:18393/ | head -1
HTTP/1.1 200 OK

$ docker run --rm --name abcl-dr-c alpine:3.20 sh -c 'grep CapEff /proc/self/status; touch /tmp/f; chown 1000 /tmp/f; echo chown rc=$?'
CapEff: 00000000a80425fb
chown rc=0
$ docker run --rm --name abcl-dr-c --cap-drop=ALL alpine:3.20 sh -c 'grep CapEff /proc/self/status; touch /tmp/f; chown 1000 /tmp/f; echo chown rc=$?'
CapEff: 0000000000000000
chown: /tmp/f: Operation not permitted
chown rc=1

$ docker run --name abcl-dr-c --cap-drop=ALL nginx:1.27-alpine
…
nginx: [emerg] chown("/var/cache/nginx/client_temp", 101) failed (1: Operation not permitted)
# exit=1. Add back only what this run needed:
$ docker run -d --name abcl-dr-c --cap-drop=ALL --cap-add=CHOWN --cap-add=SETGID \
    --cap-add=SETUID --cap-add=NET_BIND_SERVICE --cap-add=DAC_OVERRIDE \
    -p 127.0.0.1:18394:80 nginx:1.27-alpine
$ curl -sI http://127.0.0.1:18394/ | head -1
HTTP/1.1 200 OK

$ docker run --rm --name abcl-dr-c --cap-drop=ALL --read-only --security-opt no-new-privileges \
    --user 1000:1000 --memory 64m --cpus 0.5 --pids-limit 50 \
    python:3.12-alpine python -c 'print("hardened ok")'
hardened ok

# 1. what state is it in?
$ docker ps -a --filter name=abcl-dr-crash --format 'table {{.Names}}\t{{.Status}}'
NAMES           STATUS
abcl-dr-crash   Exited (1) 2 seconds ago

# 2. what did it say last? (logs work on an exited container)
$ docker logs abcl-dr-crash
starting orders service
Traceback (most recent call last):
  File "/app/app.py", line 3, in <module>
    db = os.environ["DB_URL"]
…
KeyError: 'DB_URL'

# 3. how did it end?
$ docker inspect -f 'exit={{.State.ExitCode}} oom={{.State.OOMKilled}} cmd={{.Config.Cmd}}' abcl-dr-crash
exit=1 oom=false cmd=[python /app/app.py]

# 4. exec cannot help: there is no process to join
$ docker exec abcl-dr-crash sh
Error response from daemon: container 695da60e89cc… is not running

# 5. look inside: copy from the stopped container, or start a shell from the same image
$ docker cp abcl-dr-crash:/app/app.py copied.py
$ docker run --rm --name abcl-dr-dbg --entrypoint sh abcl-dr-app:1 -c 'ls /app; env | grep -c DB_URL'
app.py
0

# 6. fix the cause and run a new container
$ docker run --rm --name abcl-dr-fix -e DB_URL=postgres://db.example/orders abcl-dr-app:1
starting orders service
connected to postgres://db.example/orders