Container Orchestration using OpenShift.

Login/Signup OpenShift Online ( free ) https://www.openshift.com/

Download the command line OpenShift client from HERE.

Extract the archive and go the directory.
Add current directory to path
export PATH=$(pwd):$PATH

narayan@ubuntu:~/Downloads/openshift-origin-client-tools-v3.9.0-alpha.3-78ddc10-linux-64bit$ oc login
Authentication required for https://api.starter-us-west-1.openshift.com:443 (openshift)
Username: #your username#
Password: #your password#
Login successful.

You can create a new project using the GUI or command line, let us create a project using commandline tool for the purpose of this tutorial.
Use a unique name for the project.

narayan@ubuntu:~/Downloads/openshift-origin-client-tools-v3.9.0-alpha.3-78ddc10-linux-64bit$ oc new-project test-templates

Now using project "test-templates" on server "https://api.starter-us-west-1.openshift.com:443".
You can add applications to this project with the 'new-app' command. For example, try:
oc new-app centos/ruby-22-centos7~https://github.com/openshift/ruby-ex.git
to build a new example application in Ruby.

You can see that the project is created in the GUI.

Go inside project, you see that there are no applications deployed.

Now let us deploy a simple hello-world-web docker image on the cluster

narayan@ubuntu:~/Downloads/openshift-origin-client-tools-v3.9.0-alpha.3-78ddc10-linux-64bit$ oc new-app narayan1ap/hello-world-web

--> Found Docker image 5c64ec0 (39 minutes old) from Docker Hub for "narayan1ap/hello-world-web"
* An image stream will be created as "hello-world-web:latest" that will track this image
* This image will be deployed in deployment config "hello-world-web"
* Port 5000/tcp will be load balanced by service "hello-world-web"
* Other containers can access this service through the hostname "hello-world-web"

--> Creating resources ...
imagestream "hello-world-web" created
deploymentconfig "hello-world-web" created
service "hello-world-web" created
--> Success
Application is not exposed. You can expose services to the outside world by executing one or more of the commands below:
'oc expose svc/hello-world-web'
Run 'oc status' to view your app.

Note that the docker image should not run as a root user otherwise you will get a warning message like below.

[WARNING] Image "example" runs as the 'root' user which may not be permitted by your cluster administrator.

By default, all containers that we try and launch within OpenShift, are set blocked from “RunAsAny” which basically means that they are not allowed to use a root user within the container. This prevents root actions such as chown or chmod from being run and is a sensible security precaution as should a user be able to perform a local exploit to break out of the container, then they would not be running as root on the underlying container host.

Refer this article: How to enable docker image to run as non-root user.

After successful deploy, GUI looks like below. You can see that there is no route associated with the deploy.

Lets associate route.

narayan@ubuntu:~/Downloads/openshift-origin-client-tools-v3.9.0-alpha.3-78ddc10-linux-64bit$ oc expose svc/hello-world-web
route "hello-world-web" exposed

Now you can click on the route and access the APP.

Static Code Analysis with Sonarqube docker image.

sudo apt-get update
sudo apt-get install default-jdk
sudo apt install docker.io
sudo usermod -aG docker $USER
logout

// login again

docker pull sonarqube
docker run -d --name sonarqube -p 9000:9000 -p 9092:9092 sonarqube

Sonar server has been started on this machine. Now you can login in to http://ip_address:9000 with admin/admin

Analyse a project.

sudo apt-get install maven
cd your_project_pom_directory
mvn sonar:sonar -Dsonar.host.url=http://ip_address:9000 -Dsonar.login=your_sonar_token

How to enable docker image to run as non-root user

The principle of least authority is an important concept in computer security, promoting minimal user profile privileges on computers, based on users' job necessities. It can also be applied to processes on the computer; each system component or process should have the least authority necessary to perform its duties. This helps reduce the "attack surface" of the computer by eliminating unnecessary privileges that can result in network exploits and computer compromises.

Containers of most of the images available in the docker hub, by default, run as the root user. This is bad because:
1) You're more likely to modify up settings that you shouldn't be
2) If an attacker gets access to your container, that's bad if they're root.

Most containerized processes are application services and therefore don’t require root access. The docker daemon currently requires root privileges but containers themselves do not. Well written, secure and reusable Docker images should not expect to be run as root and should provide a predictable and easy method to limit access. To ensure this, some of the container orchestration frameworks force the docker container to run as non-root like OpenShift.

Here's how you can change a Docker container to run as a non-root user

FROM <base image> RUN groupadd -g 1009 appg && \ useradd -r -u 1009 -g appg appuser USER appuser ... <rest of Dockerfile> ...

How to profile JVM running on a remote server docker container.

On a Ubuntu desktop install JProfiler GUI from here.

Download script and run it.
http://download-keycdn.ej-technologies.com/jprofiler/jprofiler_linux_9_2.sh

Provide key if you have , else use evaluation.

Now on the Ubuntu server where docker container is running, you need to stop containers first and modify Dockerfile to add jprofiler

wget http://download-keycdn.ej-technologies.com/jprofiler/jprofiler_linux_9_2.tar.gz && \
tar -xzf jprofiler_linux_9_1_1.tar.gz -C /usr/local

Also expose the port 8849 from container to host so that you can connect from your desktop.

If you use docker-compose.yml, map the port in the service , which you want to connect.
For example

version: "2"
services:
  some_service:
    build: .
    ports:
      - "8849:8849"
    depends_on:
      - "db"
    entrypoint:


This will download jprofiler 9.2 and unpack it in /usr/local when you run docker container next time and map the port on host server.

Once docker container is up , you can ssh to it
docker exec -it /bin/bash
And just start the jprofiler using following command.
/usr/local/jprofiler9/bin/jpenable
You will be asked for 2 options , 1) GUI connect 2. Using config.xml

Use option 1 GUI connect
Now from Desktop you can open JProfiler UI and connect to server-ip:8849
You can profile the JVM you want.