Docker từ Cơ bản đến Nâng cao

Phần 4: Security, Monitoring và CI/CD

xdev.asia

1. Docker Logging

Docker capture stdout và stderr của container process và lưu trữ thông qua logging drivers.

1.1. Logging Drivers

Driver	Mô tả	Use case
json-file	Default, lưu JSON files trên host	Development, small deployments
syslog	Gửi logs tới syslog daemon	Linux servers với rsyslog
journald	Gửi logs tới systemd journal	Systems dùng systemd
fluentd	Gửi logs tới Fluentd/Fluent Bit	EFK Stack
gelf	Graylog Extended Log Format	Graylog
awslogs	Amazon CloudWatch Logs	AWS deployments
none	Disable logging	Performance-critical

1.2. Cấu hình Logging Driver

// /etc/docker/daemon.json - Global default
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3",
    "compress": "true"
  }
}

# Per-container logging driver
docker run -d \
    --log-driver=json-file \
    --log-opt max-size=10m \
    --log-opt max-file=3 \
    myapp

# Docker Compose
services:
  api:
    image: myapp:latest
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

2. Centralized Logging

2.1. EFK Stack (Elasticsearch + Fluent Bit + Kibana)

# docker-compose.yml - EFK Stack
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.15.0
    environment:
      - discovery.type=single-node
      - ES_JAVA_OPTS=-Xms512m -Xmx512m
      - xpack.security.enabled=false
    volumes:
      - es-data:/usr/share/elasticsearch/data
    ports:
      - "9200:9200"
fluent-bit:
image: fluent/fluent-bit:3.1
volumes:
- ./fluent-bit.conf:/fluent-bit/etc/fluent-bit.conf:ro
ports:
- "24224:24224"
depends_on:
- elasticsearch
kibana:
image: docker.elastic.co/kibana/kibana:8.15.0
environment:
- ELASTICSEARCH_HOSTS=http://elasticsearch:9200
ports:
- "5601:5601"
depends_on:
- elasticsearch
Application gửi logs tới fluent-bit
api:
image: myapp:latest
logging:
driver: fluentd
options:
fluentd-address: "localhost:24224"
tag: "app.api"
volumes:
es-data:

2.2. Loki + Grafana (Lightweight alternative)

services:
  loki:
    image: grafana/loki:3.0.0
    ports:
      - "3100:3100"
    volumes:
      - loki-data:/loki
grafana:
image: grafana/grafana:11.0.0
ports:
- "3000:3000"
environment:
- GF_SECURITY_ADMIN_PASSWORD=admin
volumes:
- grafana-data:/var/lib/grafana
Install Loki Docker driver
docker plugin install grafana/loki-docker-driver:3.0.0 --alias loki --grant-all-permissions
api:
image: myapp:latest
logging:
driver: loki
options:
loki-url: "http://localhost:3100/loki/api/v1/push"
loki-labels: "app=api,env=production"
volumes:
loki-data:
grafana-data:

3. Container Monitoring

3.1. cAdvisor

services:
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.49.1
    ports:
      - "8080:8080"
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
    privileged: true

3.2. Prometheus + Grafana Stack

services:
  prometheus:
    image: prom/prometheus:v2.53.0
    ports:
      - "9090:9090"
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
node-exporter:
image: prom/node-exporter:v1.8.1
ports:
- "9100:9100"
volumes:
- /proc:/host/proc:ro
- /sys:/host/sys:ro
- /:/rootfs:ro
command:
- '--path.procfs=/host/proc'
- '--path.sysfs=/host/sys'
grafana:
image: grafana/grafana:11.0.0
ports:
- "3000:3000"
environment:
GF_SECURITY_ADMIN_PASSWORD: admin
volumes:
- grafana-data:/var/lib/grafana
volumes:
prometheus-data:
grafana-data:

# prometheus.yml
global:
  scrape_interval: 15s

scrape_configs:
  - job_name: 'cadvisor'
    static_configs:
      - targets: ['cadvisor:8080']

  - job_name: 'node-exporter'
    static_configs:
      - targets: ['node-exporter:9100']

4. Docker Events

# Real-time events
docker events
Filter events
docker events --filter "type=container"
docker events --filter "event=die"
docker events --filter "container=my-app"
Format output
docker events --format '{{.Time}} {{.Type}} {{.Action}} {{.Actor.Attributes.name}}'

5. Health Monitoring

# Comprehensive healthcheck
services:
  api:
    image: myapp:latest
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
db:
image: postgres:16
healthcheck:
test: ["CMD-SHELL", "pg_isready -U postgres"]
interval: 10s
timeout: 5s
retries: 5
redis:
image: redis:7-alpine
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 10s
timeout: 5s
retries: 3

# Check health status
docker inspect --format='{{.State.Health.Status}}' my-app
docker ps --filter "health=unhealthy"

6. Alerting Strategies

• Container OOM killed: Alert khi container bị kill do out of memory

• Container restart loop: Alert khi container restart nhiều lần

• Unhealthy status: Alert khi healthcheck fail

• High CPU/Memory usage: Alert khi vượt ngưỡng

• Disk space: Alert khi Docker data directory gần đầy

7. Tổng kết

Trong bài này, bạn đã nắm được:

• Docker logging drivers và configuration

• Centralized logging với EFK Stack và Loki

• Container monitoring với cAdvisor, Prometheus, Grafana

• Docker events tracking

• Health monitoring và alerting strategies

Bài tiếp theo sẽ hướng dẫn tích hợp Docker trong CI/CD Pipeline.