Docker từ Cơ bản đến Nâng cao

Phần 5: Production và Advanced Topics

xdev.asia

1. Từ Docker đến Kubernetes

Khi ứng dụng phát triển, Docker Compose có thể không đủ đáp ứng nhu cầu orchestration. Kubernetes mở rộng nhiều khả năng mà Docker không có.

Khi nào cần chuyển sang Kubernetes?

• Cần auto-scaling (HPA, VPA)
• Multi-node deployment với high availability
• Rolling updates phức tạp với canary, blue-green
• Service mesh (Istio, Linkerd)
• Declarative infrastructure as code
• Advanced scheduling và resource management

Docker vs Kubernetes Concepts

Docker                    →  Kubernetes
─────────────────────────────────────────
Container                 →  Pod
docker-compose.yml        →  Deployment + Service
docker run                →  kubectl run
docker build              →  kaniko / buildah
Docker Network            →  K8s Service + NetworkPolicy
Docker Volume             →  PersistentVolumeClaim
Docker Swarm Service      →  Deployment + HPA
docker-compose scale      →  kubectl scale / HPA
Docker Secrets            →  K8s Secrets
.env file                 →  ConfigMap

2. Kubernetes Basics cho Docker Developers

# Pod - đơn vị nhỏ nhất (tương tự container)
apiVersion: v1
kind: Pod
metadata:
  name: nginx
  labels:
    app: nginx
spec:
  containers:
  - name: nginx
    image: nginx:1.27-alpine
    ports:
    - containerPort: 80
    resources:
      requests:
        memory: "64Mi"
        cpu: "100m"
      limits:
        memory: "128Mi"
        cpu: "250m"

# Deployment - quản lý replicas (tương tự docker service)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
      - name: web
        image: myapp:1.0
        ports:
        - containerPort: 3000
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: url
---
# Service - expose deployment (tương tự port mapping)
apiVersion: v1
kind: Service
metadata:
  name: web
spec:
  selector:
    app: web
  ports:
  - port: 80
    targetPort: 3000
  type: ClusterIP

3. Sử dụng Kompose để Convert

# Cài đặt Kompose
curl -L https://github.com/kubernetes/kompose/releases/download/v1.33.0/kompose-linux-amd64 \
  -o kompose
chmod +x kompose
sudo mv kompose /usr/local/bin/
macOS
brew install kompose
Convert docker-compose.yml sang K8s manifests
kompose convert
Convert với options
kompose convert --file docker-compose.yml --out k8s/
kompose convert --chart  # Tạo Helm chart
Convert và apply trực tiếp
kompose up
Remove resources
kompose down

Ví dụ Convert

# docker-compose.yml (Input)
services:
  web:
    image: nginx:1.27-alpine
    ports:
      - "80:80"
    volumes:
      - web-data:/usr/share/nginx/html
    deploy:
      replicas: 3
api:
build: ./api
ports:
- "3000:3000"
environment:
DB_HOST: postgres
depends_on:
- postgres
postgres:
image: postgres:16-alpine
environment:
POSTGRES_DB: myapp
POSTGRES_USER: admin
volumes:
- pg-data:/var/lib/postgresql/data
volumes:
web-data:
pg-data:

# Kompose sẽ tạo:
# web-deployment.yaml
# web-service.yaml
# web-data-persistentvolumeclaim.yaml
# api-deployment.yaml
# api-service.yaml
# postgres-deployment.yaml
# postgres-service.yaml
# pg-data-persistentvolumeclaim.yaml

4. Container Runtime Interface (CRI)

Kubernetes không trực tiếp sử dụng Docker daemon, mà sử dụng CRI:

Kubernetes History:
K8s < 1.20:  Docker (dockershim) → Docker daemon → containerd → runc
K8s 1.20-23: dockershim deprecated
K8s ≥ 1.24:  CRI → containerd → runc  (Docker không cần thiết)
                 → CRI-O → runc
Note: Docker images vẫn hoạt động vì tuân theo OCI standard!

# Kiểm tra container runtime trên K8s node
kubectl get nodes -o wide
# CONTAINER-RUNTIME column hiển thị containerd://1.7.x

# Build image không cần Docker
# Kaniko - build trong K8s
# Buildah - rootless builds
# BuildKit - Docker BuildKit standalone

# Ví dụ Kaniko trong K8s

apiVersion: v1
kind: Pod
metadata:
  name: kaniko
spec:
  containers:
  - name: kaniko
    image: gcr.io/kaniko-project/executor:latest
    args:
    - "--dockerfile=Dockerfile"
    - "--context=git://github.com/user/repo.git"
    - "--destination=registry.example.com/myapp:latest"
    volumeMounts:
    - name: docker-config
      mountPath: /kaniko/.docker
  volumes:
  - name: docker-config
    secret:
      secretName: docker-registry-secret

5. Docker Desktop Kubernetes

# Enable K8s trong Docker Desktop
# Settings → Kubernetes → Enable Kubernetes
Kiểm tra cluster
kubectl cluster-info
kubectl get nodes
Context switching
kubectl config get-contexts
kubectl config use-context docker-desktop
Deploy app
kubectl apply -f k8s/
Xem resources
kubectl get pods,services,deployments
Port forward
kubectl port-forward svc/web 8080:80
Logs
kubectl logs -f deployment/api
Exec vào pod
kubectl exec -it pod/api-xxx -- /bin/sh

6. Helm Charts cho Docker Developers

# Cài đặt Helm
brew install helm  # macOS
# hoặc
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
Tạo Helm chart
helm create myapp
Structure
myapp/
├── Chart.yaml          # Chart metadata
├── values.yaml         # Default values
├── templates/
│   ├── deployment.yaml
│   ├── service.yaml
│   ├── ingress.yaml
│   ├── configmap.yaml
│   ├── secret.yaml
│   ├── hpa.yaml
│   └── _helpers.tpl
└── charts/             # Dependencies

# values.yaml - tương tự .env file trong Docker
replicaCount: 3

image:
  repository: myapp
  tag: "1.0"
  pullPolicy: IfNotPresent

service:
  type: ClusterIP
  port: 80

ingress:
  enabled: true
  hosts:
    - host: myapp.example.com
      paths:
        - path: /
          pathType: Prefix

resources:
  limits:
    cpu: 500m
    memory: 256Mi
  requests:
    cpu: 100m
    memory: 128Mi

autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 10
  targetCPUUtilizationPercentage: 80

# Install chart
helm install myapp ./myapp -f values-prod.yaml

# Upgrade
helm upgrade myapp ./myapp -f values-prod.yaml

# Rollback
helm rollback myapp 1

# List releases
helm list

# Uninstall
helm uninstall myapp

7. Migration Strategy

Phương pháp từng bước

Phase 1: Containerize (Docker)
  ├── Dockerfile cho mỗi service
  ├── docker-compose.yml cho local dev
  └── CI/CD build Docker images
Phase 2: Registry Setup
├── Private registry (Harbor/ECR/GCR)
├── Image scanning (Trivy)
└── Tagging strategy (semver)
Phase 3: K8s Dev Environment
├── Docker Desktop Kubernetes
├── Kompose convert
├── Fix và optimize manifests
└── Test locally
Phase 4: Staging
├── Deploy to staging K8s cluster
├── Helm charts cho deployment
├── ConfigMaps + Secrets
└── Monitoring + Logging
Phase 5: Production
├── Production K8s cluster (EKS/GKE/AKS)
├── Ingress controller
├── HPA + resource limits
├── Network policies
└── Backup + DR

8. Hybrid Deployments

Không phải mọi thứ đều cần Kubernetes ngay lập tức:

# Development: Docker Compose
# Staging/Production: Kubernetes
# Shared codebase, shared Dockerfiles
Makefile cho hybrid workflow
Makefile
.PHONY: dev staging prod
dev:
docker compose -f docker-compose.yml -f docker-compose.dev.yml up
staging:
helm upgrade --install myapp ./helm/myapp 

-f helm/myapp/values-staging.yaml 

--namespace staging
prod:
helm upgrade --install myapp ./helm/myapp 

-f helm/myapp/values-prod.yaml 

--namespace production

9. ConfigMap và Secret từ Docker

# Docker .env → K8s ConfigMap
kubectl create configmap app-config \
    --from-env-file=.env
Docker secret → K8s Secret
kubectl create secret generic db-creds 

--from-literal=username=admin 

--from-literal=password=secretpass
Docker config file → K8s ConfigMap
kubectl create configmap nginx-config 

--from-file=nginx.conf

10. Tổng kết

Trong bài này, bạn đã học:

• Docker vs Kubernetes concepts mapping

• Kubernetes basics cho Docker developers

• Kompose để convert docker-compose.yml

• Container Runtime Interface (CRI) và containerd

• Docker Desktop Kubernetes cho development

• Helm charts cho packaging và deployment

• Migration strategy và hybrid deployments

Bài tiếp theo: Production Deployment và Troubleshooting - bài cuối cùng!