Docker and file upload server

Question

I am new to the Docker concept and trying to figure out how an image and container are working. I currently have a running server with the ability to upload files on it and to crop them on demand using a PHP tool. (this is a theoretical case for this question).

As I understood: A lazy way would be:

• To make an ubuntu image with a running apache serving both the upload and cropping service.
• Then I would run a container from this image and expose the upload directory so that the uploaded content is saved somewhere on my computer.

No uploaded content will be stored in the image at anytime, all the content must be stored either within the container or on my computer through a path mapping. Is this accurate ?

PS: I am aware the good practice would be to have an upload service in a container and another running container for the crop service.

Answer 1

Yes, that is correct.

Containers can store modifications, and can even be saved to new images if desired. However, there's a limit (around ~8 GB I think unless you reconfigure it). For something like building an image library, or analyzing big data, it would be best to link in a volume in the run command with the -v option.

No matter what happens in the container, the original image is unmodified unless you explicitly overwrite that image from the host. For example, if someone uses an exploit to hijack the task in the container (like an SQL injection against poorly written code from a 3rd party that is running in the container), only that one container is modified. You could respond by stopping the exploited container, copying out some log files for forensic log examination (using docker cp ), and then running a new container from the image (which would still have the same weaknesses but without any of the unauthorized changes that might exist in the stopped container).

In your Dockerfile for building the image, you probably would expose port 80 if your apache will run on port 80. Later, when running the container with docker run you can choose whether to expose port 80 -p 80 , or remap it to another port -p 8080:80 or to remap it randomly -P