Using and Abusing Container Metadata

Using and abusing
container metadata
Liz Rice
@lizrice | @microscaling
speakerdeck.com/lizrice/using-and-abusing
-container-metadata
Agenda
● Container images and layers
● Container metadata and labels
● Metadata inheritance
● Metadata automation
Frisbee whizzing
Brian Bilston
through the air
above our heads
over the sand
into the water
onto the waves
out to sea.
You cried a lot that day.

Frisbee was a lovely dog.
Containers
Image: Lewis Clarke
Container
Images
Image: Tyler Allen

1. Container images
image
App A App B
bins / libs bins / libs
Host OS
server
docker build
Dockerfile image
Let’s make one
Create a new directory
$ mkdir tiad # or whatever you like

$ cd tiad
Create a file called greeting, something like this
Hello TIAD
Create a file called Dockerfile
FROM alpine:latest
MAINTAINER <your@email.address>
COPY greeting greeting
CMD echo `cat greeting`
Reverse
quotes
You’ll need a Docker Hub namespace
- Your Docker Hub name

- Or maybe an organization
Build the container
$ docker build -t <namespace>/tiad .
Run it
$ docker run <namespace>/tiad

Push it to Docker Hub
- You’ll need your Docker Hub repo name
$ docker push <namespace>/tiad
- You might need to log in first
$ docker login
Look at the image information
$ docker inspect <namespace>/tiad

...
"Author": "liz@lizrice.com",
...
"Cmd": [
"/bin/sh",
"-c",
"echo `cat greeting`"
],
...
"Layers": [
"sha256:9007f5987db353ec398a223bc5a135c5a9601798b...
"sha256:182229f64cf81b7c99d6009c85764eb359f636f8df2...
...
Look up your image on microbadger.com
docker build
Dockerfile image
Dockerfile Image
FROM File system layer
MAINTAINER Metadata
COPY File system layer
CMD Metadata
2. Container metadata
- Tagging
- Labels
Tagging
Distinguish between different versions of the same
image
Edit the greeting file
Build a new version of the container, with a new tag
$ docker build -t <namespace>/tiad:new .
Run it
$ docker run <namespace>/tiad:new

Push it
$ docker push <namespace>/tiad:new
Find the Webhook for your image on MicroBadger

POST to it to trigger re-inspection
$ curl -X POST
https://hooks.microbadger.com/<your webhook>
Look at it on Docker Hub (hub.docker.com) and
MicroBadger
- See both tagged versions (latest & new)

- Which is most recent?
Labelling
Add arbitrary metadata to your image
git ref
usage
Image
contact
vendor
Alarm system
automatically
connected to git ref
Reproduce contact
problem with
precise usage
codebase Image
contact
Filter
deployed
images from
vendor
vendor
label-schema.org
Standard semantics for container labels
Add labels in your Dockerfile
FROM alpine:latest
MAINTAINER <your@email.address>
COPY greeting greeting
CMD echo `cat greeting`
LABEL org.label-schema.name=“TIAD test” \
org.label-schema.description=“Whatever
you like”
Build a new version of the container with another tag
$ docker build -t <namespace>/tiad:labels .
Push it, and call your MicroBadger web hook
$ docker push <namespace>/tiad:labels
$ curl -X POST
https://hooks.microbadger.com/<your webhook>
3. Child images & inheritance
Some metadata gets handed down, and some doesn’t
Create a Dockerfile for a child image - call it
Dockerfile.child
FROM <namespace>/tiad:labels
CMD echo yo peeps
LABEL org.label-schema.description =
“Overwrites the old description”
Build the child image
$ docker build -f Dockerfile.child -t

<namespace>/tiadchild .
Push it
$ docker push <namespace>/tiadchild
Take a look at the child image on microbadger.com

Using FROM directive
- inherits labels
- doesn’t inherit MAINTAINER
You can filter images with particular labels:
$ docker images --filter "label=org.label-schema.name"
$ docker images --filter
"label=org.label-schema.name=TIAD test"
You can also filter running containers:

$ docker ps --filter "label=org.label-schema.name"
And apply labels at runtime

$ docker run --label "label=org.label-schema.name"
<namespace>/tiad:labels
Build-time labels - images are immutable
e.g.
- What code is in this image?
- Where is the documentation?
Run-time labels - can change after build

e.g.
- Test / acceptance status of this image
4. Automate with a makefile
Add up-to-date git references into your image
Initialize this directory under git
- or do this with an existing repo + image + Dockerfile
$ git init .
Add to Dockerfile:
ARG VCS_REF
LABEL org.label-schema.vcs-ref=$VCS_REF
Add substitution params to Dockerfile:
ARG VCS_REF
LABEL org.label-schema.vcs-ref=$VCS_REF
Build the image with value for that param:
$ docker build --build-arg VCS_REF=`git

rev-parse --short HEAD` .
You can include that as part of a Makefile, e.g.
default: docker_build
docker_build:
docker build \
--build-arg VCS_REF=`git rev-parse --short HEAD` \
--build-arg BUILD_DATE=`date -u +“%Y-%m-$dT%H:%M:%SZ”` .
What not to do!
● Apply ‘latest’ to an old image
● Use someone else’s email as the maintainer
● Don’t look at labels before you build from an image
MicroBadger.com
label-schema.org
@lizrice | @microscaling
Image: Peter Trimming

Using and Abusing Container Metadata

Uploaded by

Copyright:

Available Formats

Using and Abusing Container Metadata

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Using and Abusing Container Metadata

Uploaded by

Copyright:

Available Formats

Using and abusing

You cried a lot that day.

Image: Tyler Allen

$ mkdir tiad # or whatever you like

Create a file called greeting, something like this

- Your Docker Hub name

$ docker build -t <namespace>/tiad .

$ docker run <namespace>/tiad

- You’ll need your Docker Hub repo name

$ docker push <namespace>/tiad

- You might need to log in first

$ docker inspect <namespace>/tiad

COPY File system layer

Build a new version of the container, with a new tag

$ docker build -t <namespace>/tiad:new .

$ docker run <namespace>/tiad:new

$ docker push <namespace>/tiad:new

Find the Webhook for your image on MicroBadger

- See both tagged versions (latest & new)

$ docker build -t <namespace>/tiad:labels .

Push it, and call your MicroBadger web hook

$ docker push <namespace>/tiad:labels

$ docker build -f Dockerfile.child -t

$ docker push <namespace>/tiadchild

Take a look at the child image on microbadger.com

You can also filter running containers:

And apply labels at runtime

Run-time labels - can change after build

Build the image with value for that param:

$ docker build --build-arg VCS_REF=`git

You might also like