Containers: Docker and compose / Stage 4 of 11 · step 6 of 7

A new image version

~20 min

Not running Starting usually ~20 s

Situation

The team's status page runs in the app container on port 8080: this is version 1.0, the app:1.0 image. A developer prepared version 1.1: its files and Dockerfile are in ~/app. He did not get to build the image — the build kept failing for him.

Run docker commands with sudo: the student user has no direct access to Docker. There is no internet on the machine, and the busybox image is already loaded.

Task

The app:1.1 image is built from the ~/app directory: sudo docker build ~/app succeeds and gives an image with the same layers.
Container app runs from the app:1.1 image and is not restarting.
curl http://localhost:8080/ gets the version 1.1 page from container app.

Lab goals

0 of 3

The app:1.1 image is built from ~/app — building that directory gives an image with the same layers — not checked yet
Container app runs from the app:1.1 image and is not restarting — not checked yet
http://localhost:8080/ serves the version 1.1 page from container app — not checked yet

Hints

0 of 3 open · they open one at a time

Hint 1

Show the solution after 3 failed checks

Containers · picked for this lab

Dockerfile — an image recipe and docker build

Cheat sheet

$_ — insert into the terminal

sudo docker build -t app:1.1 . build from ./Dockerfile
sudo docker build -t app:1.1 -f Dockerfile.dev . another file
sudo docker build --no-cache -t app:1.1 . everything, no cache
sudo docker history app:1.1 image layers
sudo docker image inspect -f '{{json .Config.Cmd}}' app:1.1
sudo docker run --rm app:1.1 ls /www what got into the image

A site on nginx:alpine

dockerfile

FROM nginx:alpine
COPY site/ /usr/share/nginx/html/

CMD is inherited from the base: nginx is already set to run in the foreground. It serves files from /usr/share/nginx/html.

A process that is not root

dockerfile

FROM busybox
RUN adduser -D -u 1001 web
USER web
ENV GREETING=hi
CMD ["sh", "-c", "id; echo $GREETING"]

text

student@ubuntu:~$ sudo docker run --rm user:1
uid=1001(web) gid=1001(web) groups=1001(web)
hi
student@ubuntu:~$ sudo docker run --rm -e GREETING=bye user:1
uid=1001(web) gid=1001(web) groups=1001(web)
bye

adduser -D is the busybox version: a user with no password. Files from COPY belong to root wherever USER stands: the process can read them but not write to them. To hand files to the user — COPY --chown=web:web data/ /data/.

Check the image before running the service

bash

sudo docker run --rm app:1.1 ls -l /www          # files in place?
sudo docker image inspect -f '{{json .Config.Cmd}}' app:1.1
sudo docker history app:1.1                      # steps and sizes

Rebuild and swap the container

bash

sudo docker build -t app:1.2 .
sudo docker rm -f app
sudo docker run -d --name app -p 8080:80 app:1.2

A new image does not reach a running container by itself — the container has to be re-created.

DEPRECATED: The legacy builder is deprecated

The old builder runs the build: there is no buildx component (the docker-buildx package), or the DOCKER_BUILDKIT=0 variable turns it off. It is a warning; the build goes on. The error, if any, is in the last lines.

failed to resolve reference at the FROM step

The FROM image is not on the machine, so Docker went to the registry. Check the name and tag against docker images: FROM busybox means busybox:latest. Without network, load the base from a file: docker load -i /opt/images/busybox.tar.

COPY with a path above the context

The COPY path goes above the context: ../file. BuildKit counts it from the context root and answers "/file": not found; the old builder says COPY failed: forbidden path outside the build context. Put the file into the build directory — see Build context.

failed to compute cache key: not found

text

ERROR: failed to build: failed to solve: failed to compute cache key:
failed to calculate checksum of ref …: "/nosuch.html": not found

The old builder says COPY failed: file not found in build context.

The file is not in the context: a typo in the name, the build started from the wrong directory, or .dockerignore excludes the file. Check ls in the directory given as the last docker build argument.

failed to read dockerfile

failed to read dockerfile: open Dockerfile: no such file or directory (the old builder says unable to prepare context) — the context directory has no Dockerfile. Go to the application directory or name the file with -f. path "…" not found means the context directory itself is missing.

executable file not found in $PATH

text

docker: Error response from daemon: … exec: "httpd -f -p 80":
executable file not found in $PATH

The image built and the container was created but did not start (status Created): the image has no program by that name. Most often it is an exec-form CMD written as one string — split the words: ["httpd", "-f", "-p", "80"]. Or the base image lacks the program: busybox has no bash and no python.

A container from the new image exits at once with 0

The start command finished or went to the background. Check docker image inspect -f '{{json .Config.Cmd}}': a service must run in the foreground (httpd -f, nginx -g 'daemon off;').

The change did not reach the container

Check three things in order. Was the image rebuilt after the edit? Was the container created from the new image (docker inspect -f '{{.Image}}' against the image ID)? Is the edited file the one COPY copies, and not in .dockerignore? The last one shows in the COPY step of the build output: CACHED after an edit means a different file is being copied.

Secrets in layers

COPY . . without .dockerignore carries .env, keys and .git into the image. A later RUN rm .env does not help: the file stays in the COPY layer, and anyone with the image can pull it out. Exclude secrets in .dockerignore and pass them at run time: -e, --env-file.

FROM without a tag

FROM nginx means nginx:latest, whatever image sits under that name on build day. Two builds of one Dockerfile give different images. Pin a version: FROM nginx:1.27-alpine.

A new image version

Situation

Task

Signing in is needed to start the machine

A site on nginx:alpine

A process that is not root

Check the image before running the service

Rebuild and swap the container

DEPRECATED: The legacy builder is deprecated

failed to resolve reference at the FROM step

COPY with a path above the context

failed to compute cache key: not found

failed to read dockerfile

executable file not found in $PATH

A container from the new image exits at once with 0

The change did not reach the container

Secrets in layers

FROM without a tag